Some fields is duplicate in a doc

Elastic Stack Elasticsearch
1

i found some fields is duplicate in a doc.
image.
this fields is used to store nginx response code. but the values is repeat sometimes.
the part of logstash conf

  if [src_type] == "office_nginx_access" {
    grok {
        match => { "message" => ["^%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][remote_user]} \[%{HTTPDATE:time1}\]( ---%{DATA:[nginx][access][server]})? \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\" ?(\"%{DATA:[nginx][access][x_forwarded_for]}\")?"] }
    }
2

Hey, can you please attach the whole logstash config?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.