Hi Anderson,
do all "duplicated" messages have the same timestamp and the same message
ID or are they different?
Cheers,
Jochen
On Wednesday, 23 November 2016 16:29:56 UTC+1, Anderson Gabriel wrote:
>
> Hello, I have a graylog with elasticsearch configured on only 1 server. I
> am capturing jboss logs. But my messages are replicating for more than
> 20x each.
>
> Configuration logstash:
>
> input {
> filet {
> Type => "aeq-pro"
> Add_field => { "ugcs_server" => "172.29.1.114"}
> Add_field => { "ugcs_application" => "aeq-pro"}
> Add_field => { "ugcs_environment" => "production"}
> Add_field => { "ugcs_type" => "jboss-pro"}
> Path => "/nfs/prod/logs/jboss6/aeq/server.log"
> Codec => multiline {
> Pattern => "^% {TIMESTAMP_ISO8601}"
> Negate => true
> What => previous
> }
> }
> }
>
> filter {
> mutate {
> Type => "aeq-pro"
> Add_tag => [ "aeq-pro"]
> Remove_tag => [ "multiline"]
> }
> }
>
> # Output
>
> output {
> gelf {
> Host => "172.29.1.181"
> Port = "" 12212 "
> Full_message => ""
> }
> }
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/951963c4-2af4-463f-abbe-816ca133a6f8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
