Es document count != wc -l output of file after sending data with logstash?

Both Filebeat and Logstash are reliable, and they both will retry to send logs in the case of some communication error with Elasticsearch, this can in some cases lead to duplicate documents and there are ways to deal with date.

As already said your issue is specific to your case and your data, but without seeing your data and trying to replicate it is not possible to know what is the issue and how to fix it.

As asked:

Can you share a sample of your file with any private information redacted so someone can try to replicate your issue?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.