2 indices

[fooc (sander van der Laan)]

Hello,

In my new setup i created a beat.conf so i can receive my data from a windows machine with winlogbeat installed and set the output to elastic.
When i create an index i can choose betwen logstash and winlogbeat and in monitoring i'm seeing 2 indices with the same size.
I think i'm collecting and storing the data twice, what am i doing wrong?

[warkolm (Mark Walkom)]

You will probably need to share your beat and Logstash config, minus comments

[fooc (sander van der Laan)]

input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => ["http://10.0.0.46:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}

[fooc (sander van der Laan)]

settings modified in logstash.yml:

------------ Metrics Settings --------------

Bind address for the metrics REST endpoint

http.host: "10.0.0.46"

Bind port for the metrics REST endpoint, this option also accept a range

(9600-9700) and logstash will pick up the first available ports.

[Charaf_Ahmed]

Where is your winlogbeat output?

Normally you have to comment the elasticsearch output and uncomment the logstash output.

[Christian_Dahlqvist]

Are you running Logstash as a service? Do you by any chance have more than one file containing an elasticsearch output in the config directory? Be aware that Logstash will concatenate all files into a single logical pipeline, which means that data from all inputs will go to all outputs unless you control the flow using conditionals.

[fooc (sander van der Laan)]

Ah yes i found it, i had another config file for syslog, i did not use it yet so i deleted it i now its fine.

thanx for your input