# Duplicate Events captured in Indexes

**URL:** <https://discuss.elastic.co/t/duplicate-events-captured-in-indexes/86899>\
**Category:** Logstash\
**Created:** [May 24, 2017, 6:12am UTC](https://discuss.elastic.co/t/duplicate-events-captured-in-indexes/86899 "2017-05-24T06:12:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [May 24, 2017, 6:12am UTC](https://discuss.elastic.co/t/duplicate-events-captured-in-indexes/86899/1 "2017-05-24T06:12:11Z")

</div>

I have 2 indexes named MyIndex1 and MyIndex2.

I have 2 different conf files targeting multiple paths. Both conf has different paths completely. These conf at the end has individual index names. The only common thing is that both the conf files are present under a single folder named Configurations.  
I have used logstash -f Configurations as the command line to use all the conf's present under the folder.  
The problem which I am seeing here is that, events from these paths are captured successfully...but it is present in both the indexes.

Am I missing something or made a mistake ?

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 24, 2017, 6:53am UTC](https://discuss.elastic.co/t/duplicate-events-captured-in-indexes/86899/2 "2017-05-24T06:53:31Z")

</div>

When you have several conf files, logstash marges them and consider it as a unique conf file. So if your output only changes according to the file (and not other filter), then it's normal.

What you can do is, if for example, input is file type, to add a different tag in the input and then filter the output index accordingly to the tag

---

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [May 26, 2017, 2:49pm UTC](https://discuss.elastic.co/t/duplicate-events-captured-in-indexes/86899/3 "2017-05-26T14:49:59Z")

</div>

I have now added the type field as a IF check, to capture things in appropriate indexes. Thanks !!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2017, 2:50pm UTC](https://discuss.elastic.co/t/duplicate-events-captured-in-indexes/86899/4 "2017-06-23T14:50:00Z")

</div>

Closed on June 23, 2017, 2:50pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.