How do I reset the "file pointer" in filebeats

Elastic Stack Beats
1

Hello

I have filebeats forwarding logs to logstash/ELK. I have spent time developing, debugging, and getting visualizations up, and would now like to process all log files in their entirety once again. This is a similar problem to http://stackoverflow.com/questions/19546900/how-to-force-logstash-to-reparse-a-file

However, I think that I need to reset it in filebeat as opposed to logstash as I totally have cleaned out the ELK data and started fresh and I still don't see old logs.

So, the question is, how do I get filebeat to reparse all log files in entirety that it is watching?

Thanks
Nick

2

I think this is what you want - https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#_registry_file

3

That's what I wanted...thanks.