Creating new index with an already existing index pattern


Actually, I have by mistakenly deleted an index "filebeat-2020-06-05". My index gets generated on daily basis.

Now, I am trying create an index manually with older date, and trying to restore older data, but that is not working. Old data gets mapped to the latest index i.e. filebeat-2020-06-10' (or current day)

Thank You

You may want to override the output.elasticsearch.index setting and use the timestamp field from your event to set the date suffix in the index name. See That way, events from the past will go into an index with the event date as the suffix.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.