All components were 5.2.0.
I've removed all configs from logstash except our filebeat input and the elasticsearch output to remove any variables.
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["http://es-data-int.ex.com:9200"]
index => "logstash-%{environment}-%{product}-%{role}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
I also removed the %{variables} from the index name to see if that maybe causing the issue and the same prevailed.
We are in AWS using Amazon Linux for all servers. The ES data nodes are behind an ALB listening on port 9200.