Hi
I am new to ELK. I am using logstash,Redis and Elasticsearch.When I push Events from logstash Shipper to Redis and then to Logstash Indexer and Query for events in Elasticsearch it shows Events lesser than the actual count.Later if I update the input log file,the actual Events are added with the Events already indexed resulting in duplicate Events.This Happens only for the first time the Index is created.
For Example If my Log file contains 1050 Events , Initally only 50 log events are indexed,later if I add 1 event to the log file ,I get 1101 Events.
Following are my shipper and indexer configrations
Shipper.conf:
input {
file {
path => "/root/ELK/Logs_sample/pps*"
start_position => "beginning"
type => "scheduling"
}
}
output {
redis { host => "10.197.10.10" data_type => "list" key => "logs_sample" }
}
Indexer.conf :
input {
redis {
host => "10.197.10.10"
data_type => "list"
key => "logs_sample"
}
}
output {
elasticsearch {
type =>"xxx"
host => "10.10.10.10"
port => "9200"
index => "abc"
protocol => "http"
}
}
Any Solution regarding this issue will be more Helpful.