# Elasticsearch treatment of duplicate Netflow Records **URL:** \ **Category:** Elasticsearch\ **Created:** [October 10, 2014, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-treatment-of-duplicate-netflow-records/20181 "2014-10-10T14:40:27Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![warobertson](https://avatars.discourse-cdn.com/v4/letter/w/51bf81/32.png) [@warobertson](https://discuss.elastic.co/u/warobertson)\ **Post date:** [October 10, 2014, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-treatment-of-duplicate-netflow-records/20181/1 "2014-10-10T14:40:27Z")
Howdy folks, I have what I hope will be a fairly simple question for you. I'm going to be pumping netflow records into an ES cluster. In order to ensure that I catch all of these messages, I'm going to have multiple netflow destinations configured on the originating devices (routers, switches, etc) - and the records will be caught by individual Logstash instances. Unfortunately, that means that each Logstash instance will attempt to store identical netflow records into the ES cluster. I have seen mixed opinions on how ES will respond to this. Some discussions suggest that the the first CREATE attempt will succeed, and the second attempt will fail - because the record/object will already exist. That would be a good outcome, as far as I'm concerned. That's the behavior I want to see - but is that what I'll actually see? Is the object ID created in a deterministic manner, such that both Logstash instances will derive the same value? Any insight would be appreciated. Thanks, Alan -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6d2d54f8-a74e-4f71-a6ec-47dfc8035e31%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6d2d54f8-a74e-4f71-a6ec-47dfc8035e31%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warobertson](https://avatars.discourse-cdn.com/v4/letter/w/51bf81/32.png) [@warobertson](https://discuss.elastic.co/u/warobertson)\ **Post date:** [October 15, 2014, 6:29pm UTC](https://discuss.elastic.co/t/elasticsearch-treatment-of-duplicate-netflow-records/20181/2 "2014-10-15T18:29:58Z")
Bump On Friday, October 10, 2014 10:40:27 AM UTC-4, Alan Robertson wrote: > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/24cc97ff-2935-4491-9b14-d5c0752a7b04%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24cc97ff-2935-4491-9b14-d5c0752a7b04%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:55am UTC](https://discuss.elastic.co/t/elasticsearch-treatment-of-duplicate-netflow-records/20181/3 "2017-07-06T00:55:59Z")
Closed on July 6, 2017, 12:55am UTC