Creating new index with an already existing index pattern

Elastic Stack Beats
1

Hello,

Actually, I have by mistakenly deleted an index "filebeat-2020-06-05". My index gets generated on daily basis.

Now, I am trying create an index manually with older date, and trying to restore older data, but that is not working. Old data gets mapped to the latest index i.e. filebeat-2020-06-10' (or current day)

Thank You

2

You may want to override the output.elasticsearch.index setting and use the timestamp field from your event to set the date suffix in the index name. See https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es. That way, events from the past will go into an index with the event date as the suffix.

Shaunak

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.