Hello,
I'm using Logstash 6.3.2 and I've enabled the DLQ but it doesn't appear to be indexing the events back into Elasticsearch; the log files in the DLQ data directory just keep growing and all i'm seeing in logstash-plain.log is:
[WARN ][org.logstash.common.io.DeadLetterQueueWriter] Event previously submitted to dead letter queue. Skipping...
I have the following in my logstash.conf file to repair the DLQ messages so they can be indexed into Elasticsearch:
if "dlq" in [tags] {
mutate {
convert => {
"src_ip" => "string"
"dst_ip" => "string"
}
}
}
However the repaired messages I'm expecting to see in Elasticsearch aren't there.
Can anyone help?