When in,filter,out not the same event

Elastic Stack Logstash
1

hi team,

i add a couple of elapsed filters in my logstash pipeline it works properly.
but i'm wonder why in,filter and out events not same

eg:
when i start logstash service, in, filter and output events show same
a few hour laters it shows

{
"host" : "logstash-server",
"version" : "6.1.1",
"http_address" : "127.0.0.1:9600",
"id" : "b930b316-154b-4e4a-b963-b9d91d5be3ra",
"name" : "logstash-server",
"events" : {
"in" : 4964,
"filtered" : 4964,
"out" : 4970,
"duration_in_millis" : 30431,
"queue_push_duration_in_millis" : 265
}
}

and again a few min later it shows

{
"host" : "logstash-server",
"version" : "6.1.1",
"http_address" : "127.0.0.1:9600",
"id" : "b930b316-154b-4e4a-b963-b9d91d5be3ra",
"name" : "logstash-server",
"events" : {
"in" : 5310,
"filtered" : 5310,
"out" : 5318,
"duration_in_millis" : 33603,
"queue_push_duration_in_millis" : 279
}
}

and check again

{
"host" : "logstash-server",
"version" : "6.1.1",
"http_address" : "127.0.0.1:9600",
"id" : "b930b316-154b-4e4a-b963-b9d91d5be3ra",
"name" : "logstash-server",
"events" : {
"in" : 8190,
"filtered" : 8190,
"out" : 8213,
"duration_in_millis" : 61985,
"queue_push_duration_in_millis" : 754
}
}

i don't use add new_event_on_match = true in elapsed filter
why out event becomes greater than in and filter later?
could somebody explain me??

i appreciate that! :slight_smile:

2

oh i found myself
it's because "expired event" is generated that makes greater count to out event. :smiley:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.