Best practice for reimporting files into Logstash?

Elastic Stack Logstash
4

Thank you Nicolas,

I just played around a bit more and it looks like my final solution will be the following:

(The following applies to each filebeat node, but thats what deployment piplines are for, right?)

  1. copy&unzip the file to reimport
  2. deploy a custom filebeat.yml (with close_eof)
  3. run filebeat.sh on command line with -once parameter and the custom filebeat.yml

This way we achieve the following:

  1. keep the existing logstash configuration
  2. performance is ok and no issues with high load on filebeat nodes
  3. logstash persistence buffer can be used