At the beginning of February this year we started ingesting events from Autosys prod and non-prd servers. All was going well until the end of the month. At 23:59 on 28th Feb, events stopped appearing in the index to which they are being ingested. A few days later they started again at midnight. None of the missed events were collected. The log files for Autosys roll over at midnight so I would not expect events during the missing time period to be collected as the files would have been renamed.
This has happened every month since. In March the events started coming in on 3rd, April it was 4th, May on 5th and June they appeared again on the 6th. The only pattern I can see is that events reappear on the day of the month that equals the number of the month - ie 3/3, 4/4, 5/5 and 6/6. If that is the case, then events will not appear in July until 7th.
How can this be? I can see no _internal messages that help.
Can someone shed some light on this? Thanks
