# How Can I parse logs that are already indexed in elasticsearch with logstash?
**URL:** https://discuss.elastic.co/t/how-can-i-parse-logs-that-are-already-indexed-in-elasticsearch-with-logstash/166578
**Category:** Logstash
**Created:** [January 31, 2019, 2:28pm UTC](https://discuss.elastic.co/t/how-can-i-parse-logs-that-are-already-indexed-in-elasticsearch-with-logstash/166578 "2019-01-31T14:28:47Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Daniel\_Gonzalez1](https://discuss.elastic.co/u/Daniel_Gonzalez1)
#### Post date: [January 31, 2019, 2:28pm UTC](https://discuss.elastic.co/t/how-can-i-parse-logs-that-are-already-indexed-in-elasticsearch-with-logstash/166578/1 "2019-01-31T14:28:47Z")
Hello!
How can I parse logs that are already indexed? For example one of my log files has a lot of info and all the time shows up new ideas to extract the info in many different ways for many different use cases.
My question is if Logstash can read the files that are already indexed for create new fields and stuff we have like 4 years of data.
For example in Splunk all the time you can create new fields with the extraction of de data that are already indexed with the GUI it has.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 31, 2019, 2:40pm UTC](https://discuss.elastic.co/t/how-can-i-parse-logs-that-are-already-indexed-in-elasticsearch-with-logstash/166578/2 "2019-01-31T14:40:09Z")
You could use an elasticsearch input and an elasticsearch output, preserving the index name and document id from the [docinfo](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html#plugins-inputs-elasticsearch-docinfo) metadata. Alternatively, if you are just adding new fields use an elasticsearch input and write out a file using the bulk and update APIs and then use curl to POST that into elasticsearch. [This](https://discuss.elastic.co/t/aggregate-problem/142572) thread has some discussion of that.
---
### Author:  [@Daniel\_Gonzalez1](https://discuss.elastic.co/u/Daniel_Gonzalez1)
#### Post date: [January 31, 2019, 2:58pm UTC](https://discuss.elastic.co/t/how-can-i-parse-logs-that-are-already-indexed-in-elasticsearch-with-logstash/166578/3 "2019-01-31T14:58:03Z")
Hello Badger!
Actually we don't use the elasticsearch for the searchs, instead we use kibana, we want that new fields from the old logs appear there.
Do I have to do the same thing?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 31, 2019, 3:24pm UTC](https://discuss.elastic.co/t/how-can-i-parse-logs-that-are-already-indexed-in-elasticsearch-with-logstash/166578/4 "2019-01-31T15:24:53Z")
Maybe. Kibana has support for [scripted fields](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html), which are evaluated when the data is fetched from elasticsearch. That might be enough for what you want to do. But note that they get evaluated every time a fetch occurs, and there is a cost to that.
If scripted fields are not powerful enough for your use case then yes, you need to reindex.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2019, 3:24pm UTC](https://discuss.elastic.co/t/how-can-i-parse-logs-that-are-already-indexed-in-elasticsearch-with-logstash/166578/5 "2019-02-28T15:24:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.