Hi Andrew,
"I wonder if there are issues with the output keeping up with the amount
of data being sent by Packetbeat. Are you going directly to Elasticsearch?"
Yes
"Maybe you are getting some bulk rejections? Anything in the logs
(there a 30 second periodic metric dump in the beat log)?"
Bulk ?
/2017-05-09T08:23:51+02:00 INFO Error publishing events (retrying):
temporary bulk send failure/
We have this info every 30s :
/2017-05-09T08:21:12+02:00 INFO Non-zero metrics in the last 30s:
beat.memstats.gc_next=1331232 beat.memstats.memory_alloc=-37092840
beat.memstats.memory_total=229741960
output.elasticsearch.events.acked=17808
output.elasticsearch.publishEvents.call.count=359
output.elasticsearch.read.bytes=183295
output.elasticsearch.write.bytes=11037292 output.events.acked=17808
output.write.bytes=11037292 publisher.events.count=17653
publisher.queue.messages.count=30//
/
Anything interesting from |GET _nodes/stats| in ES?"
I join the output