1
answer

I'm using NXLog to read a log file and send it to Logstash.  This works fine, but some of the log lines are duplicates.  They're in separate lines, but the content is exactly the same.  I can't change the way the logs are written to the log file, so the only way is to fix it either with NXLog before it gets send, or in Logstash when it arrives, which I prefer not to do.

I see NXLog does have a function for this, but it's not working for me.  I've tried this in my config file.

<Processor norepeat>
Module pm_norepeat
</Processor>

<Route 1>
Path in => norepeat => out
</Route>

This is abviously not working for me, am I maybe missing something here?

AskedJuly 27, 2015 - 2:38pm

Answer (1)

im_file populates raw_event so you should proabably use this:

CheckFields raw_event

 

AnsweredJuly 27, 2015 - 3:23pm

Comments (1)

  • RVZ's picture

    Thanks, that seems to have worked.  :)

    July 29, 2015 - 8:29am