How to keep track on elasticsearch events

Elastic Stack Logstash
1

Hi....
here i am trying to push ES data into rabbitMq but
problem is every time i am reading total data which is present in that index
how can i keep option like since_db so that i can read each event once

here is my conf

input {
  elasticsearch {
    hosts => "192.168.1.75:9200"
    index => "netcool"
    user => "elastic"
    password => "changeme"
    query => '{ "query":{ "match_all": {} }, "sort": [ "_doc" ] }'
   # query => '{ "query":{"range" : {    "@timestamp" : {        "gt" : "now-1d   } } }, "sort": [ "_doc" ] }'
    size => 5000
    scroll => "5m"
    type => "ela"
  }
}
output{
      rabbitmq {
          key => "alerts_elk2"
          exchange => "ncoms_elk2"
          exchange_type => "direct"
          user => "admin"
          password => "rabbit@123"
          host => "192.168.1.23"
          port => 5672
          durable => true
          persistent => true
          heartbeat => "5"
          automatic_recovery => true
      }
}

Thank you

2

There's no support for that.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.