# Logstash sending duplicate \_bulk requests without any apparent reason

**URL:** <https://discuss.elastic.co/t/logstash-sending-duplicate-bulk-requests-without-any-apparent-reason/239311>\
**Category:** Logstash\
**Created:** [June 30, 2020, 1:11pm UTC](https://discuss.elastic.co/t/logstash-sending-duplicate-bulk-requests-without-any-apparent-reason/239311 "2020-06-30T13:11:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bartier](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@bartier](https://discuss.elastic.co/u/bartier)\
**Post date:** [June 30, 2020, 1:11pm UTC](https://discuss.elastic.co/t/logstash-sending-duplicate-bulk-requests-without-any-apparent-reason/239311/1 "2020-06-30T13:11:37Z")

</div>

Hello,

Today we have a setup like this:

kafka cluster --\> (4 instances) logstash 5.6.8 --\> elasticsearch cluster

Logstash instances consumes multiple topics from kafka and send \_bulk requests to elasticsearch cluster, but we found that some \_bulk requests are being duplicated . When we run our queries in Elasticsearch we found multiple items with the same values.

We observed this behavior with a tcpdump analysis. The logstash processes were running without any restarts when duplication occurs and no relevant log caught our attention.

Our big problem is: there is no duplication in kafka offsets, we confirmed this by creating another consumer group and the duplication only ocurred with only one logstash consumer group.

We are dealing with a difficult scenario to reproduce (we can observe the behavior only in production with very high throughput) and any troubleshooting suggestions would be helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2020, 1:11pm UTC](https://discuss.elastic.co/t/logstash-sending-duplicate-bulk-requests-without-any-apparent-reason/239311/2 "2020-07-28T13:11:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
