What is meant by the line "Non-zero metrics in the last 30s" in WinLogBeat logs

Elastic Stack Logstash
1

I usually see the line "Non-zero metrics in the last 30s" in WinLogBeat logs and it does not load any events. This ends with the line "Failed to publish events caused by: write tcp 127.0.0.1:63448->127.0.0.1:5044" and then it starts reading the events.

please help me understand the cause, is this an issue? Am I loosing some events which should be sent to Logstash for further parsing and I'm not getting all the info I need?

Please confirm, let me know if further details are needed from my end.

2

Are you sure your winlogbeat can connect to Logsatsh well?

3

Yes, WinLogBeat is communicating well with Logstash and both are running on the same server. Winlogbeat says this for around 5-10 minutes and resumes back. And Winlogbeat again works fine with Logstash.
Why is this gap? Should I enable high level logging of WinLogBeat if needed?

4

Can anybody please provide an update?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.