Hi , I'm facing Logstash 5.5 , is it right to create multiple pipelines under conf.d directory ?
I just created 2 pipelines with 2 different ports and it seems working but I get all messages into all of them unrelated to the ports they are listening to
input {
beats {
port => "5041"
client_inactivity_timeout => 600
codec => multiline {
pattern => "(^(%{TIME})|(%{DATESTAMP})|(%{TIMESTAMP_ISO8601})|(\[%{MONTHDAY} %{MONTH} %{YEAR} %{TIME}\]) |(%{MONTH} %{MONTHDAY}, ))|(\{)"
negate => true
what => previous
max_lines => 5000
}
}
}
input {
beats {
port => "5042"
client_inactivity_timeout => 600
codec => multiline {
pattern => "(^(%{TIME})|(%{DATESTAMP})|(%{TIMESTAMP_ISO8601})|(\[%{MONTHDAY} %{MONTH} %{YEAR} %{TIME}\]) |(%{MONTH} %{MONTHDAY}, ))|(\{)"
negate => true
what => previous
max_lines => 5000
}
}
}
so am I right all log records moving twice to elastic ? one to each pipeline ?
if it creates doubles in the elastic what are the options if I want to split to diff pipelines ?
Thanks in advance.