I tried to execute 8 logstash that accept different port and different filebeat.
I run this logstash on Linux environment.
when I run the logstash, turns out some attribute that I create by using script mutate add_field duplicates 8 times.
the values that I created manually are
- LogLevel
- logtype
- table_alias
here's the output
log.file.path
D:\Temenos\env\t24ibsm\bnk.run\XMLdriver.log
log.flags
multiline
log.offset
15,018,814
LogLevel
INFO, INFO, INFO, INFO, INFO, INFO, INFO, INFO
logtype
Temenos_XMLdriver, Temenos_XMLdriver, Temenos_XMLdriver, Temenos_XMLdriver, Temenos_XMLdriver, Temenos_XMLdriver, Temenos_XMLdriver, Temenos_XMLdriver
nama_produk_dan_versi
R10.97389 - 7576 - (jmainfunction.b,0)
rawMessage
ErrorRecord: HResult: 0x80004005Description: New transaction is not allowed because there are other threads running in the session.SQLErrorInfo: 42000Source: Microsoft SQL Server Native Client 10.0File: dbProcess.cpp, Line: 3267
I used 8 different input port
here's my input script
input {
beats {
port => 5047
}
}
here're my mutate add_field script
if "ERROR" in [rawMessage]
{
mutate {
add_field => { "LogLevel" => "ERROR" }
}
}
else if "deadlock" in [rawMessage] or "WARNING" in [rawMessage]
{
mutate {
add_field => { "LogLevel" => "WARN" }
}
}
else
{
mutate {
add_field => { "LogLevel" => "INFO"}
}
}
mutate
{
remove_field => ["category3"]
remove_field => ["dashgetter"]
remove_field => ["day","month","monthday","time","HOUR","MINUTE","SECOND"]
add_field => { "logtype" => "menos_XMLdriver" }
#add_field => {"category4_category5" => %[category4," ",category5]}
add_field => {"table_alias" => "%{table} - %{alias}"}
#add_field => {"hostname" => "menos01"}
}
if ![alias] and ![table]
{
mutate{
remove_field => ["table_alias"]
}
}
else if ![table]
{
mutate {
gsub => ["table_alias", "%{table} -", ""]
}
}
else if ![alias]
{
mutate{
gsub => ["table_alias", " - %{alias}", ""]
}
}
if logstash only running 1 input it's working perfectly
but when running 8 inputs the manual field that I created using mutate add_field becomes duplicate in the output.
Please Help