How to reimport logs after deleting them with XDELETE?

Elastic Stack Beats
1

My config is :

  • ELK server
  • Filebeat server

I made tests with old logs and wanted to delete them all by doing sudo curl -XDELETE localhost:9200/index on the ELK server. It works fine.

But now, I want to reimport these old logs and I don't know how to do that.

I tried to delete the registry file in /var/lib/filebeat/ and restart Filebeat but it didn't' work.

Any idea on how to import these logs again ?

2

The only persistent state kept by Filebeat is the registry file. The location of the registry file is determined by your configuration file. So confirm that your configuration file has the registry located at /var/lib/filebeat/registry. If that's correct, stop the Filebeat service, delete the registry file, then start the Filebeat service.

If that doesn't work, then check the logs to see if there are any errors indexing.

1 Like
4

Sorry for the delay.

It's OK, thank you.

5

This topic was automatically closed after 21 days. New replies are no longer allowed.