Index logstash (Delete)


(Salma Ait Lhaj) #1

Hello again,

I delete logstash index with DELETE methode and I want to get it back, how can I do this ?


(Christian Dahlqvist) #2

Unless you have a snapshot you can restore from, there is no way to undo a delete.


(Salma Ait Lhaj) #3

I don't want to undo the delete, but add the index an other time


(Magnus Bäck) #4

Where did the data come from in the first place, i.e. what inputs do you have in your Logstash configuration?


(Salma Ait Lhaj) #5

input {
beats {
port => "5044"
}

}
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:hostname} %{GREEDYDATA:csv_data}"}
}
csv {
source => "csv_data"
columns => [ "src_ip","dst_ip","rule_name","src_zone","dst_zone","src_int","dst_int","port","protocol","action" ]
}
}

output {
elasticsearch {
hosts => [ "localhost:9200"]
}
stdout { codec => rubydebug }
}

the other problem is that when i push logs with filebeat, i can't see the filter, i see just beat.hostname, id_ , index_ ......


(Magnus Bäck) #6

You have to make Filebeat resend the data, e.g. by shutting down Filebeat, deleting the registry file, and starting it again.

the other problem is that when i push logs with filebeat, i can't see the filter, i see just beat.hostname, id_ , index_ ......

I don't understand what you mean. Please show examples instead of attempting to describe what you believe happens.


(Salma Ait Lhaj) #7

For example I want to apply the filter on a line of logs, but, I can't see the fields that I put in the filter appear !!


(Magnus Bäck) #8

I think you've configured Filebeat to send directly to Elasticsearch, bypassing Logstash completely.


(Salma Ait Lhaj) #9

I change the configuration, ant the problem now is that logstash don't send logs to elasticsearch :

curl -XGET 'localhost:9200/filebeat-6.2.4-2018.05.09/_search?pretty&q=response=200'
{
"took" : 11,
"timed_out" : false,
"_shards" : {
"total" : 3,
"successful" : 3,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [ ]
}
}


(Magnus Bäck) #10

With the configuration you posted earlier Logstash won't post to filebeat-6.2.4-2018.05.09 but rather logstash-2018.05.09.


(Salma Ait Lhaj) #11

Thank you, I can see it


(system) #12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.