I have filebeat running as a Windows Service and configured to use logstash to send files to logz.io (listener.logz.io).
Based on the registry and filebeat.log, it appears that filebeat is able to detect new files to process, however, I do not see any logs on logz.io and running Wireshark on the VM doesn't show any activity.
Is it possible that filebeat is not sending out a file that it has processed?
Running: filebeat 6.3.2
############################# Filebeat #####################################
filebeat:
prospectors:
-
paths:
- S:\alerts\*.json
fields:
logzio_codec: json
token: XXXXX
fields_under_root: true
encoding: utf-8
ignore_older: 3h
registry_file: 'C:\Program Files\Filebeat\registry'
############################# Output ##########################################
output:
logstash:
hosts: ["listener.logz.io:5015"]
######### The below configuration is used for Filebeat 1.3 or lower
tls:
certificate_authorities: ['C:\Program Files\Filebeat\Logzio.crt']
######## The below configuration is used for Filebeat 5.0 or higher
ssl:
certificate_authorities: ['C:\Program Files\Filebeat\Logzio.crt']
logging.level: debug
logging.to_files: true
logging.files:
path: 'C:\Program Files\Filebeat'
name: filebeat.log