Hi, I have a ELK stack working with filebeat in every server I want to retrieve logs from. I have nginx, apache and monolog logs that work perfectly. Every kind of of log has his own .conf file in the conf.d folder in /etc/logstash/. I recently added a wowza.conf, installed filebeat in the wowza server. Everything is configured the same way as the others. I have no entries in kibana for that host, no matter what range of time I choose, even using "last 5 years" I have no logs. I thought it was a grok_parser_failure, but everything looks fine in the logstash-plain.log. I edited the file /etc/logstash/flogstash.yml and added "log.level: debug" and for that specific host, I read the same kind of output.
[2017-07-11T17:04:22,148][DEBUG][logstash.pipeline ] output received {"event"=>{"functionalgroup"=>"frontend", "offset"=>25380894, "scalinggroup"=>"backend", "module"=>"wowza", "input_type"=>"log", "source"=>"/usr/local/WowzaStreamingEngine/logs/wowzastreamingengine_access.log", "message"=>"2017-07-11\t17:04:10\tART\tseek\tstream\tINFO\t200\t0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil\t-\t_defaultVHost_\tvodhls\t_definst_\t4691.171\t192.168.10.86\t1935\thttp://192.168.10.86:1935/vodhls/definst/0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil/media_b1396113_t64SERfTA==_0.ts\t192.168.10.68\thttp (cupertino)\t-\tOpera/9.80 (Linux armv7l; Opera TV Store/6155) Presto/2.12.407 Version/12.51 Model/Hisense-MTK5655 /EM\t1607076926\t0\t1692704268\t1382\t4758025\t0\t1691824972\t0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil\t-\t-\t-\t-\t-\thttp://192.168.10.86:1935/vodhls/definst/0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil/media_b1396113_t64SERfTA==_0.ts\thttp://192.168.10.86:1935/vodhls/definst/0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil/media_b1396113_t64SERfTA==_0.ts\t-\thttp://192.168.10.86:1935/vodhls/definst/0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil/media_b1396113_t64SERfTA==_0.ts\t-", "type"=>"wowza", "version"=>"v5", "tags"=>["beats_input_codec_plain_applied"], "component"=>"-", "@timestamp"=>2017-07-11T20:04:17.402Z, "service"=>"nginx", "@version"=>"1", "beat"=>{"hostname"=>"stream-03", "name"=>"stream-03", "version"=>"5.5.0"}, "host"=>"stream-03", "action"=>"-", "fields"=>{}}}
I have no clue on finding what is wrong. Can anyone help me find the problem? Thanks