We have all our logfile entries in a
logs-* index and would like to tail it, choosing some special/error entries to push into another index
- How can we query ElasticSearch for all logs.* since time X where X is the last time we queried?
I imagine we'd need to persist the time we last queried in some way (file) and use this timestamp within an ES Query.
Of course there are workarounds: we could direct filebeat to send the logfile entries to
issues-*. We could also
clone certain events we are sending to
logs-* within logstash and send these to
I just feel there should be a way to tail ES.