title: Multiple identical messages with logstash/kibana
body: <p>I'm running an ELK stack on my local filesystem. I have the following configuration file set up:</p>
  
  <pre><code>input {
    file {
      path =&gt; "/var/log/rfc5424"
      type =&gt; "RFC"
    }
  }
  
  filter {
    grok {
      match =&gt; { "message" =&gt; "%{SYSLOG5424LINE}" }
    }
  }
  
  output {
    elasticsearch {
      hosts =&gt; ["localhost:9200"]
    }
  }
  </code></pre>
  
  <p>I have a kibana instance running as well. I write a line to <code>/var/log/rfc5424</code>:</p>
  
  <pre><code>$ echo '&lt;11&gt;1' "$(date +'%Y-%m-%dT%H:%M:%SZ')" 'test-machine test-tag f81d4fae-7dec-11d0-a765-00a0c91e6bf6 log [nsId orgID="12 \"hey\" 345" projectID="2345[hehe]6"] this is a test message' &gt;&gt; /var/log/rfc5424
  </code></pre>
  
  <p>And it shows up in Kibana. Great! However, weirdly, it shows up <em>six times</em>:</p>
  
  <p><a href="https://i.stack.imgur.com/2l9nG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2l9nG.png" alt="why is it showing this many times?"></a></p>
  
  <p>As far as I can tell everything about these message is identical, and I only have one instance of logstash/kibana running, so I have no idea what could be causing this duplication.</p>