# Duplicate messages created by FileBeat

**URL:** <https://discuss.elastic.co/t/duplicate-messages-created-by-filebeat/174741>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 1, 2019, 9:14am UTC](https://discuss.elastic.co/t/duplicate-messages-created-by-filebeat/174741 "2019-04-01T09:14:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Denis\_Murashov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/denis_murashov/32/43197_2.png) [@Denis\_Murashov](https://discuss.elastic.co/u/Denis_Murashov)\
**Post date:** [April 1, 2019, 9:14am UTC](https://discuss.elastic.co/t/duplicate-messages-created-by-filebeat/174741/1 "2019-04-01T09:14:00Z")

</div>

'm using FileBeat to load log messages into ElasticSearch through LogStash. The log files are located on Windows network share. The FileBeat runs on Windows machine. The problem is that some log file records are duplicated. What is interesting is the fact that duplicate records are created in moments separated in time by event some hours. In log files of FileBeat and LogStash I don't see anything critical. I know that it is not recommended to load logs with FileBeat from network share. What could be the reason of duplicate messages created by FileBeat?

There is my filebeat.yml:

filebeat.inputs:

- type: log
  - \\\<host\_name\>\\<folder\>\*.\<service\_name\>.\*.2019\*.log
  - \\\<host\_name\>\\<folder\>\*.\<service\_name\>.\*.2019\*.log...  
encoding: Windows-1251  
multiline.pattern: '^\d{4}-\d{2}-\d{2}'  
multiline.negate: true  
multiline.match: after

filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: false

setup.template.settings:  
index.number\_of\_shards: 3

output.logstash:  
hosts: ["\<some\_ip\_address\>:5044"]  
enabled: true

processors:

- add\_host\_metadata: ~
- add\_cloud\_metadata: ~

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2019, 9:18am UTC](https://discuss.elastic.co/t/duplicate-messages-created-by-filebeat/174741/2 "2019-04-29T09:18:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.