# Two records written by Logstash for each log line

**URL:** <https://discuss.elastic.co/t/two-records-written-by-logstash-for-each-log-line/97413>\
**Category:** Logstash\
**Created:** [August 17, 2017, 12:48pm UTC](https://discuss.elastic.co/t/two-records-written-by-logstash-for-each-log-line/97413 "2017-08-17T12:48:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vivek\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivek_sharma/32/46948_2.png) [@Vivek\_Sharma](https://discuss.elastic.co/u/Vivek_Sharma)\
**Post date:** [August 17, 2017, 12:48pm UTC](https://discuss.elastic.co/t/two-records-written-by-logstash-for-each-log-line/97413/1 "2017-08-17T12:48:00Z")

</div>

Hi

The ELK setup which I am using is:  
Filebeat -\> Logstash -\> Elasticsearch -\> Kibana

Filebeat configuration file is as below:

> filebeat.prospectors:
> 
> -- input\_type: log  
> paths:  
> - C:\ELK\log\*.log  
> fields:  
> tech\_stack: XXX  
> kpi\_type: YYY

The logstash configuration file is as below:

> ```
> > input {
> > beats {
> > port => 5044
> > }
> >    
> > }
> > 
> > filter {
> > grok {
> > match => { "message" => [
> 
> > "%{SYSLOGTIMESTAMP:timestamp} \[Host:%{HOSTNAME:host_name}\:-1\|Service:%{PROG:log_service_name}\|Context:%{USERNAME:context}\|Session:%{USERNAME:session_id}\|User:%{USERNAME:user_name}\|ApplicationId:%{USERNAME:application_id}\|MessageId:%{USERNAME:message_id}\|"
> > ] }
> > }
> > 	
> > mutate {
> > add_field => { "tech_stack" => "%{[fields][tech_stack]}" }
> > add_field => { "kpi_type" => "%{[fields][kpi_type]}" }
> > }
> > }
> > 
> > output {
> > elasticsearch {
> > hosts => "localhost:9200"
> > user => "elastic"
> > password => "changeme"
> > manage_template => false
> > index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" 
> > document_type => "%{[@metadata][type]}" 
> > }
> > stdout { codec => rubydebug }
> > }
> 
> ```

Now the issue is that, when I insert a record in log file, then two records are displayed for each line of log that I am inserting.

Can anyone please help.

Thanks

---

<div class="post-metadata">

**Author:** ![BigFunger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bigfunger/32/7323_2.png) [@BigFunger](https://discuss.elastic.co/u/BigFunger)\
**Post date:** [August 17, 2017, 2:09pm UTC](https://discuss.elastic.co/t/two-records-written-by-logstash-for-each-log-line/97413/2 "2017-08-17T14:09:01Z")

</div>

I'm not sure what would be causing this, but you might want to try posting this question in the [logstash discuss forum](https://discuss.elastic.co/c/logstash).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2017, 2:09pm UTC](https://discuss.elastic.co/t/two-records-written-by-logstash-for-each-log-line/97413/3 "2017-09-14T14:09:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.