Hi Adam, this might be a bug in the Beats input plugin. Please update the plugin to the latest stable release for your version of Graylog: https://github.com/Graylog2/graylog-plugin-beats/releases
Cheers, Jochen On Tuesday, 1 November 2016 14:14:28 UTC+1, Adam wrote: > > Hi, > > I'm currently using Winlogbeat to send security logs from our Domain > Controllers to Graylog. When the messages get there I'm seeing duplicates > of every event. > > For example a log off event on the DC itself is a single event, yet when I > look at it in Graylog I see two entries. Both entries have the same > winlogbeat_record_number so I'm pretty sure it's not Winlogbeat sending the > event twice as I'd expect to see different record numbers. > > The Winlogbeat config file on the server is pretty simplistic; it just > sends the security log to a single output. > > Has anyone come across this before? Currently we're using double the > amount of disk space than we actually need and it makes statistics > unreliable. > > Thanks, > > Adam > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/9b74b280-1cd8-4872-94ba-dd067405ada4%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
