Hosts dropped to 1

[tgriep]

Could you try deleting the Listener for the Windows Log files and recreate it?
After that, reboot your server and see if they start logging after 10 minutes of running.

[itbilling]

Where would that be located?

[tgriep]

Click on "Administration", "Global Configuration" if where the inputs are defined.

You should see one in there called "Windows Event Log (Default)"
Lets try and disable it by clicking on the "Active" button next to it to make it Inactive.

Now click in the "Add Input" button, "Custom" and create a new input called "New Windows Event Log" and past this in to the field.

Code: Select all

tcp {
    type => 'eventlog'
    port => 3515
    codec => json {
        charset => 'CP1252'
    }
}

Click "Save and Apply"

Try that and see if that works for you.

Logserver.png

[itbilling]

That seems to have no change, I'm still not receiving any logs and showing only one host.

[tgriep]

Could you run this and post the output?

Code: Select all

 service iptables status

[itbilling]

I turned off the firewall, I can turn it back on if needed, but it wasn't working before I turned it off either:

iptables: Firewall is not running.

[tgriep]

The firewall being off is OK for now.

Can you go to "Administration", "Cluster Status" and show us a screen capture of that?

[itbilling]

See Attached.

[cmerchant]

With the firewall down, you can issue this query to the backend of logserver:

Code: Select all

http://192.168.4.55:9200/_plugin/head/

and show us a screen shot, it should look something like this:

screen.png

s:

send us the output of that screen. Thanks.