#logstash

hi

i am getting error while starting logstash file input on Solaris: NotImplementedError: stat.st_dev unsupported or native support failed to load

System details: SunOS sz1248 5.10 Generic_148888-05 sun4u sparc SUNW,SPARC-Enterprise

Did some googling but wasn't able to find a solution

anybody aware of this error?

hello how are you all ?

i got a question about kibana query can anyone help me with it

newbie question - if I add shipper and indexer conf files in the conf.d directory of an ubuntu machine, and starting the logstash service, I am seeing the entire log file being added repeatedly into elasticsearch

i am trying to test the example in the logstash book I just bought on my desktop

if shipper and indexer are run by different instances of logstash it works as expected though.

just wanted to know if using shipper and indexer in the same instance is wrong, or is this a bug?

sandip: it could work but very much depends on your config. it could be that you created a loop :-)

electrical: thanks for replying. my config is really very basic. it is similar to the initial examples in the book. http://pastebin.com/5YDYRQxA

Title: [Ruby] ##### # Shipper #### input { file { type => "syslog" p - Pastebin.com (at pastebin.com)

oh, is the filter getting applied to the redis input as well? in any case, i saw this "loop" before I even added the filter.

Its applied to the redis input as well yeah

oh ***, i see what you mean, the shipper is outputting to both elasticsearch and redis

so, to force an order, i should use tags and if conditions

The problem is that you have 2 outputs that are active, the Redis output + ES output. each event is sent to both. at that moment the redis input pulls it from redis and sends it to both outputs again

so you have a loop that keeps repeating it self

:( i see

its not really easy to solve it. best to run 2 separate LS processes.