1

I'm doing some testing for a POC with logstash. When using redis to buffer messages it appears they stay in redis and continually get added to elasticsearch as new events. For example, if I restart a service I'll see the same event many times when looking in Kibana.

If I remove the redis layer it works fine. It seems like I'm missing something to have the record cleared from redis but I haven't been able to figure out what. Here is my logstash config:

input.conf

input {
        syslog {
           type => "syslog-relay"
        port => 5514
    }
}


output {
  redis {
    host => "localhost"
    data_type => "list"
    key => "logstash"
  }
}

output.conf

input {
  redis {
    host => "localhost"
    type => "redis-input"
    data_type => "list"
    key => "logstash"
  }
}

output {
  elasticsearch {
    hosts => "localhost"
  }
}

0

You must log in to answer this question.

Browse other questions tagged .