Cause: The eventrouter intentionally generates duplicate event logs rather not to lose them. Fix: Extended the elasticsearch_genid plugin to elasticsearch_genid_ext so that it takes the alt_key and alt_tag. If a log message has a tag matched the alt_tag value, it uses the alt_key value as the elasticsearch primary key. We could specify a field which is shared among the duplicate events to alt_key, which eliminates the duplicate events from the elasticsearch. Sample filter using elasticsearch_genid_ext @type elasticsearch_genid_ext hash_id_key viaq_msg_id alt_key kubernetes.event.metadata.uid alt_tags "#{ENV['GENID_ALT_TAG'] || 'kubernetes.var.log.containers.kube-eventrouter-*.** kubernetes.journal.container._default_.kubernetes.event'}" </filter> Result: There's no duplicate event logs indexed in the elasticsearch.