Results after replacing action "update" with action "create":
Without any duplicated event, this was the result:
Since I found the solution, I will close this thread.
2 Likes
Did you tested with memory queue at any point?
Yes, as I mentioned here I changed filebeat disk queue to memory, and every test made after that included that change.