When I try to create a custom grok pattern to filter postfix component (qmgr, anvil,...), some fields added unexpectedly.
My logstash configuration file: http://pastebin.com/PhYDELss
My custom postfix grok pattern: http://pastebin.com/Nu1iExib
When running logstash, some fields duplicated: (component, hostname, pid, timestamp) : http://i.imgur.com/b3oTyNE.png
Could someone explain why this happened? And how can I remove the duplicated field?
Thanks
[link][comment]