I've a scenario where I need to read the file contents from an NFS mount point using filebeat. Also, I need to install another filebeat instance on another system incase the first machine (where i installed filebeat) goes for a maintenance. How can I switch the filebeat instance, without data duplication in the elasticseach? Note that both the machines has the same NFS share mounted locally.
You could start to explicitly set the _id field... that way is the best way to prevent duplicates typically. Make sure that they go into the same index though!
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.