Are they mongo logs or system logs? Because by default the system metricset is also enabled in Metricbeat. Just check a couple of documents for the module field.
2020-09-14T12:27:57.652Z ERROR mongodb/mongodb.go:98 Error establishing direct connection to mongo node at [ip-*.ec2.internal:27017]. Error output: no reachable servers
Oh then, let's try and open one of the visualization in from the dashboard and investigate more. You can use the inspect menu to see the requests and response from Elasticsearch. Check to see if there's anything there that doesn't match your data: maybe a different index pattern name or something.
# Module: mongodb
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/6.8/metricbeat-module-mongodb.html
* module: mongodb
metricsets:
* dbstats
* status
* collstats
* metrics
* replstatus
period: 10s
# The hosts must be passed as MongoDB URLs in the format:
# [mongodb://][user:pass@]host[:port].
# The username and password can also be set using the respective configuration
# options. The credentials in the URL take precedence over the username and
# password configuration options.
hosts: ["*.ec2.internal:27017"]
# Optional SSL. By default is off.
ssl.enabled: true
# Mode of verification of server certificate ('none' or 'full')
ssl.verification_mode: 'full'
# List of root certificates for TLS server verifications
ssl.certificate_authorities: ["/etc/pki/tls/certificates/CA.crt"]
# Certificate for SSL client authentication
ssl.certificate: "/etc/pki/tls/certificates/server.pem"
# Client Certificate Key
ssl.key: "/etc/pki/tls/certificates/server.key"
# Username to use when connecting to MongoDB. Empty by default.
username: ****
# Password to use when connecting to MongoDB. Empty by default.
password: ******
~
~
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.