Messages before 1PM (5AM UTC) china time never appeared in graylog. New messages start poping at 1:00PM.
All messages before 1:00 never arrived.
I have light setup, filebeat, sidecar, graylog, with just 2 log files parsed and pushed to the graylog.
Log files created at the morning ~8AM China and data starts (explicitly flushed) into it.
Filebeat start pushing data into graylog, but graylog does not display anything until 1PM.
After 1PM everything works as expected.
Both filebeat and graylog run on machine with same China timezone.
Pattern is consistent across the dates and all machines in here.
Any suggestion where to look?
# Needed for Graylog
filebeat.inputs: - input_type: log paths: - /home/user1/log_*.log type: log output.logstash: hosts: ["loghost.com:5044"] path: data: /var/lib/graylog-sidecar/collectors/filebeat/data logs: /var/lib/graylog-sidecar/collectors/filebeat/log