I have a running HCP 1.9.1 with standalone squid as sample demo log,
If I trigger new log: squidclient -h 127.0.0.1 "http://www.atmape.ru"
I don't see it right away in Kibana, but if I restart metron services in Ambari, I see it gets indexed,
See below the new one is squid_index_2019.05.09.21 after metron restart in progress..
perhaps it is a default behavior to buffer it and delay the indexing process?
Where can I find this settings?
I thought it should be coming in right away?
But I'm more suspicious that I'm missing something here...
thanks for the help!