Log lines appearing twice

#1

Hello

I'm shipping json logs to Logstash and have used below config:

input {

beats {
port => 5044
}
beats {
port => 5045

}
}
filter{
if ([fields][app] == "abc") {
json {
source => "message"
}
split {
field => "message"
}
}
}
output {
elasticsearch {
hosts => "localhost:9200"
}
}

=======================
This is resulting in log lines to be appearing twice. Can someone please help me. I have tried few things that did not work out, like using mutate to remove the message field.

Thanks

#2

You are using a split filter, so you should expect multiple events for each input line. What does the input event look like?

#3

Input is log lines in json format. Is the filter incorrect?

#4

Can I please get an answer on how to fix this please

#5

I have removed the split filter but still see multiple lines. Can someone please help me with a fix for this.