# Duplicate Message from Two Indices **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [August 6, 2019, 10:38pm UTC](https://community.graylog.org/t/duplicate-message-from-two-indices/11482 "2019-08-06T22:38:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [August 6, 2019, 10:38pm UTC](https://community.graylog.org/t/duplicate-message-from-two-indices/11482/1 "2019-08-06T22:38:33Z")
All, I’ve just recently solved my issue for retaining message for a year by creating another Index set. My problem is I’m getting duplicate messages now. During my controlled testing I made a failed logging attempt using the default index set only and the stream called “Linux: Failed Authentication” connected to it. Then I create the second Index set called “Failed Authentication” and edited the stream “Linux: Failed Authentication” to use “Failed Authentication” index set. When attempting to create one failed login, I now see duplicates message in global search ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b73beddaec94939c598575c5c7b6bbd0383046f6.png) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/20bc915dda80837a3b599205c77ecb703d499cd7.png) My environment is one node with Elasticsearch 6.8.2, MongoDB v4.0.11, and Graylog Server 3.0.2+1686930. I’m using the “default Index set”, (Shards:4, Index rotation strategy: Index Time, Rotation period: P1D, Index retention strategy: Delete, Max number of indices:30) Then my second index set “Failed Authentication” (Shards:4, Index rotation strategy: Index Time, Index retention strategy: Delete, Max number of indices:2, Rotation period: P1Y) By having duplicates my Histogram graph is higher then it normally should be. I have looked through the forum and did a google searched on this, I’ve have seen solution to fix this, but none that seemed to help my situation like the client/s sending dups to graylog server, etc… Any advice how to prevent this would be greatly apperciated. Thank you… ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [August 6, 2019, 10:52pm UTC](https://community.graylog.org/t/duplicate-message-from-two-indices/11482/2 "2019-08-06T22:52:43Z")
I’m a N00b, ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/43d36b41a133975e8d1f6ac40576575d4e32ba02.png) Solve by a tick box 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 20, 2019, 10:52pm UTC](https://community.graylog.org/t/duplicate-message-from-two-indices/11482/3 "2019-08-20T22:52:44Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.