Backfill with previous indexed data

Elastic Stack Logstash
1

problem01
problem01775×656 46.1 KB

using logstash, is it available ?

input {
  elasticsearch {
    hosts => "localhost"
    index => "logs"
    query => '{ "sort": [ "timeinfo" ] }'
  }
}
filter {
 if [location] == "" {
   // how to get previous data in here?
  }
}
2

I resolved this issue with Aggregate filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.