Hello Magnus,
Thank you for the reply, I think i got it. I was backing up older conf files in same directory as i made changes and apparently logstash continues to read those although they don't have the .conf extension
- 10-syslog.conf.old
- 10-syslog.conf.orig
Discovered it when i started seeing syslog_hostname have 3 duplicates. and ofcourse my .orig still has the date filter.
Thank you