I believe this is more oriented to logstash but
If I run as root:
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/01-winlogbeat-somefile.conf
Kibana sees the index file, so it is created and as long as I am running that, the index grows I can search etc....
Now, if the Logstash dameon is run, systemctl, the index is NOT created, data does NOT grow, I cannot search, etc.
Ive been at this for DAYS and I simply cannot get the answer.
The data folder is owned by logstash and I see the process is ran by logstash. Ive tried to run the dameon as root as well but it does not work.
I dont see anything in /var/log/messages
Can someone PLEASE help me out? Im going crazy.