When I use elasticsearch input, sometimes logstash refers several times my result in succession.
I don't understand why.
Sometimes it works, sometimes not and nevertheless neither my configuration nor my data changed.
Providing your config as well as what versions of things you are using would be helpful.
I use logstash 1.5.4 and logstash-filter-elasticsearch 0.1.6 and my conf files look like :
input {
elasticsearch {
hosts => ["my host"]
index => "my index"
query => 'my query 1'
type => "my type 1"
scan => false
}
}
filter {
elasticsearch {
hosts => ["my host/my index/my type 2"]
query => "my query 2"
fields => ["my fields:my fields"]
}
...