0

I could see that some junk indexs are generating with the normal in logstash. Why?

Steve
  • 1
  • 1

1 Answers1

0

It sounds like because Weblogic is doing log buffering, logstash is seeing a partial line (201) and discarding it and then seeing the remainder of the line later. You could try setting the log buffer size in WL to 0 to see if that fixes the problem or adjust your pattern so that it's looking for a 4 digit year explicitly... that might miss log entries though.

Alcanzar
  • 16,985
  • 6
  • 42
  • 59