Dead letter queue duplicating the stream

Hi Elastic folks,

I’m using the ElasticStack 6.1.1 and have been trying to configure the dead letter queue feature with the following:


- main
  path.config: ...
- dead
  path.config: ...

I’ve enabled DLQ in logstash.yml and here is dead_letter_queue.conf:

input {
    dead_letter_queue {
        path => ...
        commit_offsets => true
        pipeline_id => "main"

output {
    hosts => ...
    index => "dead-logs"

The main pipeline writes its output to the "active-logs" ES index.

But what happens is every event that is written successfully to "active-logs" is also rewritten exactly the same in "dead-logs"!

Did I misunderstood the use of DLQ?


Any idea on this ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.