2 indices


In my new setup i created a beat.conf so i can receive my data from a windows machine with winlogbeat installed and set the output to elastic.
When i create an index i can choose betwen logstash and winlogbeat and in monitoring i'm seeing 2 indices with the same size.
I think i'm collecting and storing the data twice, what am i doing wrong?

You will probably need to share your beat and Logstash config, minus comments :slight_smile:

input {
beats {
port => 5044

output {
elasticsearch {
hosts => [""]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

settings modified in logstash.yml:

------------ Metrics Settings --------------

Bind address for the metrics REST endpoint

http.host: ""

Bind port for the metrics REST endpoint, this option also accept a range

(9600-9700) and logstash will pick up the first available ports.

Where is your winlogbeat output?

Normally you have to comment the elasticsearch output and uncomment the logstash output.

Are you running Logstash as a service? Do you by any chance have more than one file containing an elasticsearch output in the config directory? Be aware that Logstash will concatenate all files into a single logical pipeline, which means that data from all inputs will go to all outputs unless you control the flow using conditionals.

Ah yes i found it, i had another config file for syslog, i did not use it yet so i deleted it i now its fine.

thanx for your input

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.