I've a scenario where I need to read the file contents from an NFS mount point using filebeat. Also, I need to install another filebeat instance on another system incase the first machine (where i installed filebeat) goes for a maintenance. How can I switch the filebeat instance, without data duplication in the elasticseach? Note that both the machines has the same NFS share mounted locally.
You could start to explicitly set the _id field... that way is the best way to prevent duplicates typically. Make sure that they go into the same index though!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.