# How to dump last 15 minutes of logstash data from elasticsearch? **URL:** \ **Category:** Elasticsearch\ **Created:** [April 12, 2014, 5:18pm UTC](https://discuss.elastic.co/t/how-to-dump-last-15-minutes-of-logstash-data-from-elasticsearch/16976 "2014-04-12T17:18:12Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![nyaqua](https://avatars.discourse-cdn.com/v4/letter/n/c4cdca/32.png) [@nyaqua](https://discuss.elastic.co/u/nyaqua)\ **Post date:** [April 12, 2014, 5:18pm UTC](https://discuss.elastic.co/t/how-to-dump-last-15-minutes-of-logstash-data-from-elasticsearch/16976/1 "2014-04-12T17:18:12Z")
Greetings all, I'm a novice elasticsearch user (I've recently begun monitoring a cluster with logstash, elasticsearch and kibana. I'd like to be able, via cron, to dump the last 15 minutes of logging data received to an external filesystem (which will be pruned to only keep the last week or so of dumps). I'd then like to import these files into a clean ES environment and, thereby, have essentially the last week from the original ES environment. Is this possible? Thanks much, NA -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 21, 2014, 12:23pm UTC](https://discuss.elastic.co/t/how-to-dump-last-15-minutes-of-logstash-data-from-elasticsearch/16976/2 "2014-04-21T12:23:17Z")
Hey, you could use a scroll request for this task with a specific query. See > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. As this simply returns JSON, you could use another script to import it into another elasticearch environment. If you need some sort of backup functionality, the snapshot/restore API might be interesting as well, see > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. --Alex On Sat, Apr 12, 2014 at 7:18 PM, nyaqua [botemout@gmail.com](mailto:botemout@gmail.com) wrote: > Greetings all, > > I'm a novice elasticsearch user (I've recently begun monitoring a cluster > with logstash, elasticsearch and kibana. I'd like to be able, via cron, to > dump the last 15 minutes of logging data received to an external filesystem > (which will be pruned to only keep the last week or so of dumps). I'd then > like to import these files into a clean ES environment and, thereby, have > essentially the last week from the original ES environment. Is this > possible? > > Thanks much, > NA > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGCwEM9HzpUOdoL-c\_7G9ptwfR0TPNVTyNwNiHsORiuHhn%3D%2BcA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGCwEM9HzpUOdoL-c_7G9ptwfR0TPNVTyNwNiHsORiuHhn%3D%2BcA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![nyaqua](https://avatars.discourse-cdn.com/v4/letter/n/c4cdca/32.png) [@nyaqua](https://discuss.elastic.co/u/nyaqua)\ **Post date:** [April 21, 2014, 2:32pm UTC](https://discuss.elastic.co/t/how-to-dump-last-15-minutes-of-logstash-data-from-elasticsearch/16976/3 "2014-04-21T14:32:01Z")
Thanks much, Alexander; I'll have a look. On Monday, April 21, 2014 8:23:17 AM UTC-4, Alexander Reelsen wrote: > Hey, > > you could use a scroll request for this task with a specific query. See > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-request-scroll.html#search-request-scroll) > > As this simply returns JSON, you could use another script to import it > into another elasticearch environment. If you need some sort of backup > functionality, the snapshot/restore API might be interesting as well, see > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/blog/introducing-snapshot-restore/) > > --Alex > > On Sat, Apr 12, 2014 at 7:18 PM, nyaqua \<[bote...@gmail.com](mailto:bote...@gmail.com) \\>wrote: > > > Greetings all, > > > > I'm a novice elasticsearch user (I've recently begun monitoring a cluster > > with logstash, elasticsearch and kibana. I'd like to be able, via cron, to > > dump the last 15 minutes of logging data received to an external filesystem > > (which will be pruned to only keep the last week or so of dumps). I'd then > > like to import these files into a clean ES environment and, thereby, have > > essentially the last week from the original ES environment. Is this > > possible? > > > > Thanks much, > > NA > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9a4e9f43-9d4f-491a-8748-452e0305167a%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/acaf5be9-4180-48e4-852c-335d79b9f7a6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/acaf5be9-4180-48e4-852c-335d79b9f7a6%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:34am UTC](https://discuss.elastic.co/t/how-to-dump-last-15-minutes-of-logstash-data-from-elasticsearch/16976/4 "2017-07-06T01:34:31Z")