Logstash sends multiple copies of data

Hello everyone,
need you help on next question:

I have 5 logstash.conf file to run.
They are equal and only "Input path/.../....log" is different.

[sudo] password for maxim:

input {
file {
path => "/var/log/test.log"
start_position => "beginning"
}
}

output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "logstash3-%{+YYYY.MM.dd}"
document_type => "my_test3_doc"

}
stdout {}
}

In fact,
logstash sends me 5 messages per input using the same data.
The only one field is different is "_id".

For example,
I have 5 conf files then I receive 5 times messages for each on of them... (5x5 = 25 in total).
If I have 20 conf files simultaneously then I will receive 20 duplicated messages with different _id. 20 x 20 = 400 Messages in total).
How to stop sending copies?
Do I need to change Document_id? I tried and not sure that correctly.
Please advise.

All config files in the directory are concatenated into a single pipeline. This means that each event generated by an input plugin will go through all filters and be sent to all outputs (all 5 of them). You can get around this by creating a single config file with multiple inputs, use conditionals or use the relatively new multiple pipeline feature. This is a common misunderstanding so you should easily be able to find examples.

1 Like

Thanks. Now i know where to dig.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.