0

I'm using NXLog to read a log file and send it to Logstash. This works fine, but the some of the log items are duplicates. They're in separate lines, but the content is exactly the same. I can't change the way the logs are written to the log file, so the only way is to fix it either with NXlog before it gets send, or in Logstash when it arrives, which I prefer not to do.

NXlog does have a function for this, but it's not working for me.

<Processor norepeat>
Module  pm_norepeat
</Processor>

<Route 1>
Path in => norepeat => out
</Route>

After this I'm still receiving the duplicates in Logstash. Any ideas?

RVZ
  • 13
  • 6

1 Answers1

0

im_file populates raw_event so you should probably use this:

CheckFields raw_event

See the answer here.

b0ti
  • 2,319
  • 1
  • 18
  • 18