Hi, I'm trying to understand the metrics returned by _node/stats/pipelines
in logstash. I'm quite confused why the number of out events is exactly doubles the number of in events. Shouldn't it be the same? main
is the pipleline I used, its configuration file is below:
input {
beats {
port => "5044"
host => "${HOSTNAME}"
}
}
filter {
ruby {
# this filter takes an event and return an empty event array or an array with single event
# it shouldn't be the reasonof double number of out events.
path => "./parse_instances.rb"
}
date {
match => ["time", "EEE MMM dd HH:mm:ss z yyyy"]
remove_field => ["time"]
}
}
output {
if [message] {
elasticsearch {
template => "./failure.json"
template_name => "failure"
hosts => [ "localhost:9200" ]
index => "failure-%{+yyyy}"
}
}
else {
elasticsearch {
template => "./success.json"
template_name => "success"
hosts => [ "localhost:9200" ]
index => "success-%{+yyyy}"
}
}
}
Metrics:
"main" : {
"events" : {
"duration_in_millis" : 8765,
"in" : 1066,
"out" : 2132,
"filtered" : 2132,
"queue_push_duration_in_millis" : 0
},
"plugins" : {
"inputs" : [ {
"id" : "14c41567c86423438cefc7d9c899fef42411103535961a93a24df",
"events" : {
"out" : 1066,
"queue_push_duration_in_millis" : 0
},
"current_connections" : 0,
"name" : "beats",
"peak_connections" : 1
} ],
"filters" : [ {
"id" : "caaf3633f39897fe41837858c0dbe3bded9b072b8e73d90c2447388991",
"events" : {
"duration_in_millis" : 252,
"in" : 2132,
"out" : 1066
},
"matches" : 1066,
"name" : "date"
}, {
"id" : "607eb7136bcd2626d9f2c111cbfc0ff9da96a94f5d7bf3d07a04528",
"events" : {
"duration_in_millis" : 4847,
"in" : 1066,
"out" : 1066
},
"name" : "ruby"
} ],
"outputs" : [ {
"id" : "3dc66707f76e38d6a9aa3d99349fdd54200fb89fb518c5a9375351a4a1",
"documents" : {
"successes" : 48
},
"events" : {
"duration_in_millis" : 903,
"in" : 48,
"out" : 48
},
"bulk_requests" : {
"successes" : 12,
"responses" : {
"200" : 12
}
},
"name" : "elasticsearch"
}, {
"id" : "c20ee0cbdd30d9089b283c5ad18ad8c726c7e8e2cac8b7b090ed6",
"documents" : {
"successes" : 1018
},
"events" : {
"duration_in_millis" : 2632,
"in" : 1018,
"out" : 1018
},
"bulk_requests" : {
"successes" : 24,
"responses" : {
"200" : 24
}
},
"name" : "elasticsearch"
} ]
},