Hello @Marwan_Ghonem
Welcome to the Community!!
Could you please share the filebeat.yml in order to understand why the older indices are created again?
It can be related to the registry path :
Similar older issue :
I have filebeats reading the log files on a remote server and shipping it to logstash on the same server. I have tried deleting the last 6 months old indices but I have noticed that indices are recreated on the elastic search. Can you correct me where i'm doing wrong I went with the default configuration. Thanks
paths:
#- /var/log/*.log
- \\webserver10\iislogs\*.log
output.logstash:
# Boolean flag to enable or disable the output module.
#enabled: true
# The Logstash hosts
ho…
Thanks!!
1 Like