How to handle erroring logs, that just stick around

We have been running Logstash in production for a while. When I restart Logstash, it seems that logstash is attempting to resend Logs that have errors in them "Could not index event to ElasticSearch", caused by problems "failed to parse [xxx]".

These are older logs, going back to months.

Is logstash attempting to reparse these erroring logs? Are they attempting to just resend them? Is there anything I can do to either fix the parsing, or just clear them out of the pipeline?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.