How did you solve this issue I am facing this issue right now,
I am taking logs from journalctl and giving input in logstash, then logstash sent it to kibana.
The last log from journalbeat-7.2 is repeating continuously in kibana, but there is only one entry of that log in journalctl.
journalbeat.inputs:
- paths: ["/var/log/journal/ec2a64c31fceb7b6eee4bd5"]
seek: cursor
include_matches:
- "syslog.identifier=XXXXXXX"
setup.template.settings:
index.number_of_shards: 1
setup.kibana:
output.logstash:
hosts: ["xxx.xxx.xxx.xx:XXXX"]
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~