We have ELK stack running in Prod.
we do see .raw attributes in kibana for Dev, Qa and UAT but in prod env. However the version in Prod is same as Dev, Qa and UAT.
Logstash - 2.3
ElasticSearch - 2.2.0
Kiban - 4.4.1
FileBeat Linux- 1.1.1
FileBeat Windows - 1.1.1
Please do help.
even after creating index with logstash-*, I don't see .raw fields.