Excess data in elasticsearch

Hi! I have a problem with excess in elasticsearch. When I run logstash with one config file, I have right quantity hits in index. When I have a few config files, which logstash processing, I have the same quantity in each index. How to solve this problem?

green open .kibana 1 0 5 0 40.5kb 40.5kb
yellow open index1 5 1 492 398 507.2kb 507.2kb
yellow open index2 5 1 492 0 381.1kb 381.1kb
yellow open index3 5 1 492 0 382.6kb 382.6kb

Logstash concatenates multiple configuration files so unless you use conditionals data from all inputs will go to all outputs.

How to divide pipelines?

Either you need to use conditionals to control the flow of data or use the relatively new multi-pipeline feature to separate them.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.