Duplicate content in indexes

[motts]

I had this issue myself. Turns out, there was an error in the Kibana index in Elasticseaerch. I got rid of that Kibana index and data was going to the correct indices.

Make sure the only files in /logstash/logstash.conf directory are only .conf files for logstash as well.

See here:

Data is sent to created index and the default index

I have an interesting issue where data is being sent to the new index and also the old default index. I am using Elasticsearch 2.4 and here is my output file: output { if [type] == "Corporate" { elasticsearch { hosts => ["localhost:9200"] index => "corp_windows_events-%{+YYYY-MM-dd}" } } else { elasticsearch { hosts => ["localhost:9200"] } } } I checked both indic…