# Elasticsearch to Elasticsearch duplicating messages

**URL:** <https://discuss.elastic.co/t/elasticsearch-to-elasticsearch-duplicating-messages/78511>\
**Category:** Logstash\
**Created:** [March 14, 2017, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-to-elasticsearch-duplicating-messages/78511 "2017-03-14T12:18:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JeremyinNC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremyinnc/32/44868_2.png) [@JeremyinNC](https://discuss.elastic.co/u/JeremyinNC)\
**Post date:** [March 14, 2017, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-to-elasticsearch-duplicating-messages/78511/1 "2017-03-14T12:18:44Z")

</div>

Using ES 2.4.4 and Logstash 2.4.1 with the following config logstash appears to "loop" though the query results, ending up with the same documents being written over and over. Can someone help me figure out what I'm doing wrong?

```
input {
   elasticsearch {
   hosts => "es-analytics-int.dev.company.com"
   index => "logstash-event-*"
   size => 100
  query => '{"query":{"range":{"timestamp":{"gte":"2017-02-10T00:00:00.000Z","lte":"2017-03- 12T23:59:59.999Z"}}}}'
}}

filter {
  mutate {
    remove_field => ["@timestamp"]
    remove_field => ["@version"]
  }
date {
    locale => en
    match => ["sentTimestamp" , "dd/MMM/yyyy:HH:mm:ss Z" , "yyyy-MM-dd HH:mm:ss,SSS" , "yyy-MM-dd HH:mm:ss,SSSZ" , "ISO8601"]
    }

}
output {
        elasticsearch {
          hosts => "127.0.0.1"
         index => "logstash-%{type}-%{+YYYY.MM}"
      }
  }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2017, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-to-elasticsearch-duplicating-messages/78511/2 "2017-04-11T12:18:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.