Wrong source file name

Elastic Stack Logstash
1

The file name in the OOB source field is wrong.
I see that in the output of the logstash.

For example the message "\n|I |17:03:22 |41 |server |Correlati......" is coming from source file ICSServerManager_stdout.log00066 and not ICSServerManager_stdout.log00016

 "host" => "vpelastic",
    "source" => "/home/vpwrk1/ElasticDataForTest/OMS/ICSServerManager_stdout.log00016",
   "message" => "\n|I |17:03:22 |41 |server |CorrelationID=ICSServerManager_41_1490195002320 |The RegistryAgent::'ICSServerManager' is starting the Socket communication: \n\t The Socket configuration: SocketConfig[Registry]\n \n\t The MulticastSocket configuration: MulticastSocketConfig[Registry]\n \n|I |17:03:22 |41 |server |CorrelationID=ICSServerManager_41_1490195002320 |JMXRegistryAgent listening on port: 56694.\n|I |17:03:22 |41 |server |CorrelationID=ICSServerManager_41_1490195002320 |Registry listening on port: 55148.\n|I |17:03:22 | JmxRegistryAgent has created the new MulticastSocket: java.net.MulticastSocket@542a983a\n\tSO_BROADCAST [true]\n\tSO_RCVBUF [4194304]\n\tSO_REUSEADDR [true]\n\tSO_SNDBUF [4194304]\n\tSO_TIMEOUT [0]\n\tTRAFFIC_CLASS [0]\n\tTIME_TO_LIVE [1]\n\tLOOPBACK_MODE [false]",
      "type" => "oms-server-ics-manage-stdout-log",
      "tags" => [
    [0] "multiline",
    [1] "beats_input_codec_multiline_applied",

What can be the problem?

Thanks
Sharon.

2

Depend what your config looks like I guess.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.