I'm doing some testing for a POC with logstash. When using redis to buffer messages it appears they stay in redis and continually get added to elasticsearch as new events. For example, if I restart a service I'll see the same event many times when looking in Kibana.
If I remove the redis layer it works fine. It seems like I'm missing something to have the record cleared from redis but I haven't been able to figure out what. Here is my logstash config:
input.conf
input {
syslog {
type => "syslog-relay"
port => 5514
}
}
output {
redis {
host => "localhost"
data_type => "list"
key => "logstash"
}
}
output.conf
input {
redis {
host => "localhost"
type => "redis-input"
data_type => "list"
key => "logstash"
}
}
output {
elasticsearch {
hosts => "localhost"
}
}
0 Answers