Clear any inflight events in memory before starting Logstash after restart

Elastic Stack Logstash
1

We're sending logs using filebeats to Logstash (Parsing with configs) --> LumberJack --> ES. In some situations while collecting newer data types, we want to re-index data,
so we do the following -

  1. stop filebeats
  2. stop logstash
  3. Change any logstash filters
  4. Delete Filebeat registry to re-read data
  5. start Logstash
  6. Start Filebeat

But during the step 5, when logstash is started, I think it tries to resend any inflight events it maybe holding up in the memory and creates the indexes with stale data in ES, but I want to prevent that from happening in this situation. I haven't been able to figure out any settings related that would help me preventing transmission of these events, as I want to re-index data.

Any suggestions or directions will be really helpful.

Thank you

2

Following

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.