How to re-analyze data that has already been ingested?

I was trying to figure out how to extract a field from a set of log messages, and most of the answers online suggest that you should handle this upstream, by using dissect on filebeat or something like that.

What do I do if I have a ton of log messages that have already been ingested without dissect, and I want to analyze them?

This is not really a Kibana question, but you can define an ingest pipeline like shown here:

For extracting a field you can use the grok processor for example:

and then re-index your data through the pipeline:


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.