Deleted Dictionary data not removed from memory until restart

Elastic Stack Logstash
1

Hello,
I am using Logstash 5 with dictionary lookups and a refresh interval of 60 seconds. I am having an issue where if I remove a line from a yml file, the change is not picked up until i restart Logstash. Adding or changing data works fine and updates without a restart. Has anyone else run across this and maybe have a work-around?

Thanks
Chris

2

I can't think of a work around.

The existing dictionary is merged with newly read dictionary - so old K/V will stick around.

Maybe change the value of a no-longer-valid key to "__no_longer_valid" and add some processing to remove the field if that value is seen?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.