Hi Anderson,
do all "duplicated" messages have the same timestamp and the same message
ID or are they different?
Cheers,
Jochen
On Wednesday, 23 November 2016 16:29:56 UTC+1, Anderson Gabriel wrote:
>
> Hello, I have a graylog with elasticsearch configured on only 1 server. I
> am capturing jboss logs. But my messages are replicating for more than
> 20x each.
>
> Configuration logstash:
>
> input {
> filet {
> Type => "aeq-pro"
> Add_field => { "ugcs_server" => "172.29.1.114"}
> Add_field => { "ugcs_application" => "aeq-pro"}
> Add_field => { "ugcs_environment" => "production"}
> Add_field => { "ugcs_type" => "jboss-pro"}
> Path => "/nfs/prod/logs/jboss6/aeq/server.log"
> Codec => multiline {
> Pattern => "^% {TIMESTAMP_ISO8601}"
> Negate => true
> What => previous
> }
> }
> }
>
> filter {
> mutate {
> Type => "aeq-pro"
> Add_tag => [ "aeq-pro"]
> Remove_tag => [ "multiline"]
> }
> }
>
> # Output
>
> output {
> gelf {
> Host => "172.29.1.181"
> Port = "" 12212 "
> Full_message => ""
> }
> }
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/951963c4-2af4-463f-abbe-816ca133a6f8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
