# Some fields is duplicate in a doc

**URL:** <https://discuss.elastic.co/t/some-fields-is-duplicate-in-a-doc/124073>\
**Category:** Elasticsearch\
**Created:** [March 15, 2018, 10:28am UTC](https://discuss.elastic.co/t/some-fields-is-duplicate-in-a-doc/124073 "2018-03-15T10:28:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wander1024](https://avatars.discourse-cdn.com/v4/letter/w/2acd7d/32.png) [@wander1024](https://discuss.elastic.co/u/wander1024)\
**Post date:** [March 15, 2018, 10:28am UTC](https://discuss.elastic.co/t/some-fields-is-duplicate-in-a-doc/124073/1 "2018-03-15T10:28:09Z")

</div>

i found some fields is duplicate in a doc.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/1/8104e34d4948053c86ea696985d29ee191baa34d.png).  
this fields is used to store nginx response code. but the values is repeat sometimes.  
**the part of logstash conf**

```auto
  if [src_type] == "office_nginx_access" {
    grok {
        match => { "message" => ["^%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][remote_user]} \[%{HTTPDATE:time1}\]( ---%{DATA:[nginx][access][server]})? \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\" ?(\"%{DATA:[nginx][access][x_forwarded_for]}\")?"] }
    }

```

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [March 23, 2018, 12:58pm UTC](https://discuss.elastic.co/t/some-fields-is-duplicate-in-a-doc/124073/2 "2018-03-23T12:58:02Z")

</div>

Hey, can you please attach the whole logstash config?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2018, 12:58pm UTC](https://discuss.elastic.co/t/some-fields-is-duplicate-in-a-doc/124073/3 "2018-04-20T12:58:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.