# Updating data doubles and then triples the hit count on kibana
**URL:** https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458
**Category:** Logstash
**Created:** [July 9, 2019, 5:47am UTC](https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458 "2019-07-09T05:47:21Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@tinamina12](https://discuss.elastic.co/u/tinamina12)
#### Post date: [July 9, 2019, 5:47am UTC](https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458/1 "2019-07-09T05:47:21Z")
I am trying to parse logs. whenever new logs are written in input file, the logstash reads the whole log file again and adds them in the exisiting parsed logs. my configuration is below. please guide me what am i doing wrong.
\*\* Configuration \*\*
input {
file {
path =\> "/home/elk/Desktop/policypermit.log"
start\_position =\> "beginning"
type =\> 'ppermit'
sincedb\_path =\> '/dev/null'
}
file {
path =\> "/home/elk/Desktop/policydeny.log"
type =\> 'pdeny'
start\_position =\> "beginning"
sincedb\_path =\> '/dev/null'
}
}
filter{
if [type] == "pdeny" {
grok {
match =\> ["message", "\ USG6300 %%01POLICY/6/POLICYDENY(l):\ vsys=public, protocol=%{WORD:pnum}, source-ip=%{IP:src}, source-port=%{WORD:port}, destination-ip=%{IP:dest}, destination-port=%{WORD:destp}, time=%{GREEDYDATA:timestamp}, source-zone=%{WORD:szone}, destination-zone=%{WORD:dzone}, rule-name=%{GREEDYDATA:rname}"]
```
}
```
mutate
{
remove\_field =\> ["message"]
}
}
else if [type] == "ppermit"{
grok {
match =\> ["message", "\ USG6300 %%01POLICY/6/POLICYPERMIT(l):\ vsys=public, protocol=%{WORD:pnum}, source-ip=%{IP:src}, source-port=%{WORD:port}, destination-ip=%{IP:dest}, destination-port=%{WORD:destp}, time=%{GREEDYDATA:timestamp}, source-zone=%{WORD:szone}, destination-zone=%{WORD:dzone}, rule-name=%{GREEDYDATA:rname}"]
```
}
```
mutate
{
remove\_field =\> ["message"]
}
}
}
output {
if [type] == "pdeny" {
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "alog"
}
}
else
{
elasticsearch {
hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
index =\> "blog"
}
}
stdout { codec =\> rubydebug }
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 9, 2019, 5:56am UTC](https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458/2 "2019-07-09T05:56:24Z")
> [@tinamina12](#):
>
> sincedb\_path =\> '/dev/null'
This means that Logstash will not keep track of what it has read across restarts. Removing this or setting it to a valid path should resolve the problem.
---
### Author:  [@tinamina12](https://discuss.elastic.co/u/tinamina12)
#### Post date: [July 9, 2019, 6:29am UTC](https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458/3 "2019-07-09T06:29:35Z")
> [@Christian\_Dahlqvist](#):
>
> sincedb\_path =\> '/dev/null'
removed it, but still getting the duplicates. is there something to do with start\_position?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 9, 2019, 7:18am UTC](https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458/4 "2019-07-09T07:18:20Z")
Do you have any other files in the config directory, e.g. older versions? Logstash concatenates all files which means all data will go to all outputs unless conditionals are used.
---
### Author:  [@tinamina12](https://discuss.elastic.co/u/tinamina12)
#### Post date: [July 9, 2019, 9:14am UTC](https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458/5 "2019-07-09T09:14:31Z")
Nope, no other file. i have tried using fingerprint filter and it seems to solve my problem for now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 6, 2019, 9:14am UTC](https://discuss.elastic.co/t/updating-data-doubles-and-then-triples-the-hit-count-on-kibana/189458/6 "2019-08-06T09:14:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.