Excess data in elasticsearch

Elastic Stack Logstash
1

Hi! I have a problem with excess in elasticsearch. When I run logstash with one config file, I have right quantity hits in index. When I have a few config files, which logstash processing, I have the same quantity in each index. How to solve this problem?

green open .kibana 1 0 5 0 40.5kb 40.5kb
yellow open index1 5 1 492 398 507.2kb 507.2kb
yellow open index2 5 1 492 0 381.1kb 381.1kb
yellow open index3 5 1 492 0 382.6kb 382.6kb

2

Logstash concatenates multiple configuration files so unless you use conditionals data from all inputs will go to all outputs.

3

How to divide pipelines?

4

Either you need to use conditionals to control the flow of data or use the relatively new multi-pipeline feature to separate them.

2 Likes
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.