Winlogbeat can't send events to Elasticsearch

Elastic Stack Beats
1

Hello. We have near 2300 EPS comming on each WEC Windows collector and near 350 EPS that winlogbeat ship to Logstash or Elasticsearch (i test both).
I try a lot of things on winlogbeat side, but nothing happen. Then i i change output from Elastic to local file.
And EPS increase from 350 to 4000 eps (and than to 2300). I also sure that problem is not in network connection.

image-2020-02-12-12-11-56-527
image-2020-02-12-12-11-56-527836×220 20 KB

So, now i am sure that problem is in Elasticsearch.
But when i check its log - i do not find nothing about dropping events. (journalctl -fu logstash or elasticsearch).

So, my question - how can i determine, that elasticsearch do not recieve events and my events drops?

2

Do anybody have any comments? Simple question- how to determine and monitor, that Elastic can't recive all events that winlogbeat sends?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.