Logstash always output input event type as log

Elastic Stack Logstash
1

Hi,
I've configured logstash input for different type. but when it ouputs elastic search, value of type filed is coming as "log". No matter what i configure type value in input section, it's being outputted as "log". my configuration look like this without filter like below. can you please let me know what's going wrong with this?

input {
beats {
port => 10044
type => "hotfix"
ssl => false

ssl_certificate => "/etc/pki/tls/certs/logstash/logstash.crt"

ssl_key => "/etc/pki/tls/certs/logstash/logstash.key"

}
}
output {
elasticsearch {
hosts => "localhost:9200"
sniffing => true
manage_template => false
index => "logstash-%{type}-%{+YYYY.MM.dd}" --> type coming as "log"
document_type => "%{[@metadata][type]}"
}

2

The "log" type comes from the Beats side and it appears Logstash won't overwrite any existing type with the one listed in the input plugin. How about you configure the type in Beats instead?

3

Further to @magnusbaeck comment

On your source server, edit the filebeat.yml and add document_type: hotfix to your prospector. Remove type => "hotfix" from your input filter and that should give you what you need.

4

Thanks, a lot. that helped.
I'm also facing an issue when I configure multiple beats(on different ports) in the input section. Each beat receives the same set of logs but from different setups.
Some reason only one beat at a time working. Another beat connection is being closed with error

Beats::Connection::ConnectionClosed wrapping: EOFError, End of file reached>, :level=>:warn}

Do I need to add any configuration apart for adding one more beat in input section?