[syslog-ng] Help! CentOS 7 ELK Stack from repos no index data.

Fabien Wernli wernli at in2p3.fr
Thu Sep 8 15:45:12 CEST 2016

On Thu, Sep 08, 2016 at 03:43:17PM +0200, Fabien Wernli wrote:
> >        		custom_id("syslog-ng")
>             ^^^^^^^^^^^^^^^^^^^^^^
> There's your problem: all documents will be assigned the literal "syslog-ng"
> as _id, so you're basically pushing all data overwriting the same document
> again and again :-)

so the fix is simply to drop that option altogether

More information about the syslog-ng mailing list