Can you enabled the file output and check if the output in the file is in one event or multiple events? Alternatively you can run filebeat with -e -d "publish" to see the events.
BTW: Which version of filebeat are you using?
Can you enabled the file output and check if the output in the file is in one event or multiple events? Alternatively you can run filebeat with -e -d "publish" to see the events.
BTW: Which version of filebeat are you using?
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.