How can I verify all logs have been shipped?

(Aviv Cohn) #1


I have configured FileBeat to ship a log file to Elasticsearch directly.
After all harvesters have already automatically stopped with a close_inactive message, I ran a count check in the filebeat indices in ES.

While the number of lines in the log file is 689398 according to wc -l, the number of documents in the index is only 6849.

Does this mean that not all logs have been shipped? What should I do?

Thank you

(Mario Castro) #2

Hi @AvivCohn :slight_smile:

Have you check the contents of the registry file?

At the same time, it might be helpful if you give us some information like the configuration used, version of Filebeat and the size and format of the logs file.

(Moved to Filebeat category)

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.