Dead letter queue duplicating the stream

Elastic Stack Logstash
1

Hi Elastic folks,

I’m using the ElasticStack 6.1.1 and have been trying to configure the dead letter queue feature with the following:

pipelines.yml:

- pipeline.id: main
  path.config: ...
- pipeline.id: dead
  path.config: ...

I’ve enabled DLQ in logstash.yml and here is dead_letter_queue.conf:

input {
    dead_letter_queue {
        path => ...
        commit_offsets => true
        pipeline_id => "main"
    }
}

output {
    hosts => ...
    index => "dead-logs"
}

The main pipeline writes its output to the "active-logs" ES index.

But what happens is every event that is written successfully to "active-logs" is also rewritten exactly the same in "dead-logs"!

Did I misunderstood the use of DLQ?

Thanks.

2

Any idea on this ?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.