Feed lost data to ELK

I suspect this is more of a question for the logstash forum, it being upstream of elasticsearch.