I am trying to leverage the information on the metrics.log file.
I am using this: index=_internal source=metrics.log group=tcpin_connections
This was working before and for some reason unknown it is not any more (nobody knows what happened).
I created a | table groups so I could see all the groups in the file and I could not see tcpin*.
I go to the log file and I actually see tcpin*
Any ideas on what's going on?