# Index logstash (Delete) **URL:** \ **Category:** Logstash\ **Created:** [May 7, 2018, 2:34pm UTC](https://discuss.elastic.co/t/index-logstash-delete/130849 "2018-05-07T14:34:37Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![asalma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asalma/32/32199_2.png) [@asalma](https://discuss.elastic.co/u/asalma)\ **Post date:** [May 7, 2018, 2:34pm UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/1 "2018-05-07T14:34:37Z")
Hello again, I delete logstash index with DELETE methode and I want to get it back, how can I do this ? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 7, 2018, 2:42pm UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/2 "2018-05-07T14:42:58Z")
Unless you have a snapshot you can restore from, there is no way to undo a delete. ---
**Author:** ![asalma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asalma/32/32199_2.png) [@asalma](https://discuss.elastic.co/u/asalma)\ **Post date:** [May 7, 2018, 2:45pm UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/3 "2018-05-07T14:45:21Z")
I don't want to undo the delete, but add the index an other time ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 7, 2018, 2:46pm UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/4 "2018-05-07T14:46:46Z")
Where did the data come from in the first place, i.e. what inputs do you have in your Logstash configuration? ---
**Author:** ![asalma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asalma/32/32199_2.png) [@asalma](https://discuss.elastic.co/u/asalma)\ **Post date:** [May 7, 2018, 2:55pm UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/5 "2018-05-07T14:55:47Z")
input { beats { port =\> "5044" } } filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{HOSTNAME:hostname} %{GREEDYDATA:csv\_data}"} } csv { source =\> "csv\_data" columns =\> ["src\_ip","dst\_ip","rule\_name","src\_zone","dst\_zone","src\_int","dst\_int","port","protocol","action"] } } output { elasticsearch { hosts =\> ["localhost:9200"] } stdout { codec =\> rubydebug } } the other problem is that when i push logs with filebeat, i can't see the filter, i see just beat.hostname, id\_ , index\_ ...... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 7, 2018, 5:33pm UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/6 "2018-05-07T17:33:30Z")
You have to make Filebeat resend the data, e.g. by shutting down Filebeat, deleting the registry file, and starting it again. > the other problem is that when i push logs with filebeat, i can't see the filter, i see just beat.hostname, id\_ , index\_ ...... I don't understand what you mean. Please show examples instead of attempting to describe what you believe happens. ---
**Author:** ![asalma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asalma/32/32199_2.png) [@asalma](https://discuss.elastic.co/u/asalma)\ **Post date:** [May 9, 2018, 7:14am UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/7 "2018-05-09T07:14:11Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a36c3cdebf61d6c324447cd7ef3d9819d8e310f7.png) For example I want to apply the filter on a line of logs, but, I can't see the fields that I put in the filter appear !! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2018, 8:18am UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/8 "2018-05-09T08:18:29Z")
I think you've configured Filebeat to send directly to Elasticsearch, bypassing Logstash completely. ---
**Author:** ![asalma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asalma/32/32199_2.png) [@asalma](https://discuss.elastic.co/u/asalma)\ **Post date:** [May 9, 2018, 9:30am UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/9 "2018-05-09T09:30:25Z")
I change the configuration, ant the problem now is that logstash don't send logs to elasticsearch : curl -XGET 'localhost:9200/filebeat-6.2.4-2018.05.09/\_search?pretty&q=response=200' { "took" : 11, "timed\_out" : false, "\_shards" : { "total" : 3, "successful" : 3, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 0, "max\_score" : null, "hits" : [] } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2018, 10:55am UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/10 "2018-05-09T10:55:56Z")
With the configuration you posted earlier Logstash won't post to filebeat-6.2.4-2018.05.09 but rather logstash-2018.05.09. ---
**Author:** ![asalma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asalma/32/32199_2.png) [@asalma](https://discuss.elastic.co/u/asalma)\ **Post date:** [May 9, 2018, 11:57am UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/11 "2018-05-09T11:57:13Z")
Thank you, I can see it ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2018, 11:57am UTC](https://discuss.elastic.co/t/index-logstash-delete/130849/12 "2018-06-06T11:57:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.