# Log lines appearing twice

**URL:** <https://discuss.elastic.co/t/log-lines-appearing-twice/193532>\
**Category:** Logstash\
**Created:** [August 2, 2019, 12:22pm UTC](https://discuss.elastic.co/t/log-lines-appearing-twice/193532 "2019-08-02T12:22:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [August 2, 2019, 12:22pm UTC](https://discuss.elastic.co/t/log-lines-appearing-twice/193532/1 "2019-08-02T12:22:59Z")

</div>

Hello

I'm shipping json logs to Logstash and have used below config:

```
input {

```

beats {  
port =\> 5044  
}  
beats {  
port =\> 5045

}  
}  
filter{  
if ([fields][app] == "abc") {  
json {  
source =\> "message"  
}  
split {  
field =\> "message"  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
}  
}

=======================  
This is resulting in log lines to be appearing twice. Can someone please help me. I have tried few things that did not work out, like using mutate to remove the message field.

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 2, 2019, 1:41pm UTC](https://discuss.elastic.co/t/log-lines-appearing-twice/193532/2 "2019-08-02T13:41:23Z")

</div>

You are using a split filter, so you should expect multiple events for each input line. What does the input event look like?

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [August 2, 2019, 1:54pm UTC](https://discuss.elastic.co/t/log-lines-appearing-twice/193532/3 "2019-08-02T13:54:08Z")

</div>

Input is log lines in json format. Is the filter incorrect?

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [August 5, 2019, 6:31am UTC](https://discuss.elastic.co/t/log-lines-appearing-twice/193532/4 "2019-08-05T06:31:22Z")

</div>

Can I please get an answer on how to fix this please

---

<div class="post-metadata">

**Author:** ![Eva](https://avatars.discourse-cdn.com/v4/letter/e/dbc845/32.png) [@Eva](https://discuss.elastic.co/u/Eva)\
**Post date:** [August 7, 2019, 5:02am UTC](https://discuss.elastic.co/t/log-lines-appearing-twice/193532/5 "2019-08-07T05:02:26Z")

</div>

I have removed the split filter but still see multiple lines. Can someone please help me with a fix for this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 5:11am UTC](https://discuss.elastic.co/t/log-lines-appearing-twice/193532/6 "2019-09-04T05:11:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.