Journalbeat doesn't send messages from journald into Logstash. In debug logs, only error I see: Error while reading event: failed to get realtime timestamp: 99 According to https://github.com/elastic/beats/issues/11933 , it means what in journald there are no new events. But if I launch journalctl …

Journalbeat didn't see messages

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Journalbeat didn't see messages