No entries in kibana for a specific host

Hi, I have a ELK stack working with filebeat in every server I want to retrieve logs from. I have nginx, apache and monolog logs that work perfectly. Every kind of of log has his own .conf file in the conf.d folder in /etc/logstash/. I recently added a wowza.conf, installed filebeat in the wowza server. Everything is configured the same way as the others. I have no entries in kibana for that host, no matter what range of time I choose, even using "last 5 years" I have no logs. I thought it was a grok_parser_failure, but everything looks fine in the logstash-plain.log. I edited the file /etc/logstash/flogstash.yml and added "log.level: debug" and for that specific host, I read the same kind of output.

[2017-07-11T17:04:22,148][DEBUG][logstash.pipeline ] output received {"event"=>{"functionalgroup"=>"frontend", "offset"=>25380894, "scalinggroup"=>"backend", "module"=>"wowza", "input_type"=>"log", "source"=>"/usr/local/WowzaStreamingEngine/logs/wowzastreamingengine_access.log", "message"=>"2017-07-11\t17:04:10\tART\tseek\tstream\tINFO\t200\t0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil\t-\t_defaultVHost_\tvodhls\t_definst_\t4691.171\t192.168.10.86\t1935\thttp://\t192.168.10.68\thttp (cupertino)\t-\tOpera/9.80 (Linux armv7l; Opera TV Store/6155) Presto/2.12.407 Version/12.51 Model/Hisense-MTK5655 /EM\t1607076926\t0\t1692704268\t1382\t4758025\t0\t1691824972\t0a933b92-09fa-4f43-881b-58ebc2108ad5_ToyStory3/media/ToyStory3_HD_es_nosub.smil\t-\t-\t-\t-\t-\thttp://\thttp://\t-\thttp://\t-", "type"=>"wowza", "version"=>"v5", "tags"=>["beats_input_codec_plain_applied"], "component"=>"-", "@timestamp"=>2017-07-11T20:04:17.402Z, "service"=>"nginx", "@version"=>"1", "beat"=>{"hostname"=>"stream-03", "name"=>"stream-03", "version"=>"5.5.0"}, "host"=>"stream-03", "action"=>"-", "fields"=>{}}}

I have no clue on finding what is wrong. Can anyone help me find the problem? Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.