Hello,
yesterday we noticed a strange problem. We depolyed 19 Nginx-VMs with Terraform / Ansible, those 19 VMs had the exactly the same configuration, regarding the filebeat config.
In Kibana / Discover we were able to find / filter for all 19 VMs. In one of our dashboards we have an visulization which counts ALL records for event.module = nginx on the Dashboard we added a filter (host.hostname) for those 19 VMs but the filter ignored the last 10 Hosts, we just got the count of records for the first 9 Hosts, the other ones weren't counted. After that we changed the filter from host.hostname to host.ip and with host.ip as filter we got the correct count of all records. We also have another dashboard which also counts all event.module: nginx but without an filter, from there we got on track that the count of records on the first dashboard is wrong.
Does anyone have an idea or explanation for this behavior?
Kind regards
Boris