# Journalbeat and Filebeat store the same messages, how should that be handled?

**URL:** <https://discuss.elastic.co/t/journalbeat-and-filebeat-store-the-same-messages-how-should-that-be-handled/230436>\
**Category:** Beats\
**Created:** [April 29, 2020, 8:37pm UTC](https://discuss.elastic.co/t/journalbeat-and-filebeat-store-the-same-messages-how-should-that-be-handled/230436 "2020-04-29T20:37:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Post date:** [April 29, 2020, 8:37pm UTC](https://discuss.elastic.co/t/journalbeat-and-filebeat-store-the-same-messages-how-should-that-be-handled/230436/1 "2020-04-29T20:37:31Z")

</div>

Journald and syslog can contain the exact same data at times.

For example, running ansible generates lots of "echo BECOME-SUCCESS-\< random string \>" messages. I can find the exact same messages in both my journalbeat-\* and filebeat-\* indexes.

What strategies do you use to deal with that kind of duplication?

Do you watch for it, then tell filebeat or journalbeat to drop events that the other one covers?

Does journald contain all the information syslog would, so we could just ignore syslog?

Any other ideas?

---

<div class="post-metadata">

**Author:** ![jerrac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerrac/32/52980_2.png) [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Post date:** [May 7, 2020, 7:15pm UTC](https://discuss.elastic.co/t/journalbeat-and-filebeat-store-the-same-messages-how-should-that-be-handled/230436/2 "2020-05-07T19:15:10Z")

</div>

Just a little bump.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2020, 9:16pm UTC](https://discuss.elastic.co/t/journalbeat-and-filebeat-store-the-same-messages-how-should-that-be-handled/230436/3 "2020-06-04T21:16:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.