Hello
I'm shipping json logs to Logstash and have used below config:
input {
beats {
port => 5044
}
beats {
port => 5045
}
}
filter{
if ([fields][app] == "abc") {
json {
source => "message"
}
split {
field => "message"
}
}
}
output {
elasticsearch {
hosts => "localhost:9200"
}
}
=======================
This is resulting in log lines to be appearing twice. Can someone please help me. I have tried few things that did not work out, like using mutate to remove the message field.
Thanks