# Is it possible apply grok in oldest logs? **URL:** \ **Category:** Logstash\ **Created:** [June 28, 2017, 12:56pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104 "2017-06-28T12:56:48Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![joao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao/32/83447_2.png) [@joao](https://discuss.elastic.co/u/joao)\ **Post date:** [June 28, 2017, 12:56pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/1 "2017-06-28T12:56:48Z")
Hello, I need to apply the grok filter in oldest logs, is it possible? Because I need to creat new fields. Thank you very much. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 1:06pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/2 "2017-06-28T13:06:22Z")
You mean you want to reprocess old logs that already have been stored in Elasticsearch? It's possible but it's a fairly involved process. ---
**Author:** ![joao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao/32/83447_2.png) [@joao](https://discuss.elastic.co/u/joao)\ **Post date:** [June 28, 2017, 1:16pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/3 "2017-06-28T13:16:56Z")
Yes this is that I want. How could I do it? For example, I've stored my logs without filters, but now I need to create some fields, so I created some filters using grok. But I've been observed that the filter it's work just after the date that I applied the grok's filter. Reprocess the old logs is the best way? Thank you. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 1:35pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/4 "2017-06-28T13:35:23Z")
If you have the raw logs it's probably easier to delete what you currently have in ES and run all the old logs through Logstash again. ---
**Author:** ![joao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao/32/83447_2.png) [@joao](https://discuss.elastic.co/u/joao)\ **Post date:** [June 28, 2017, 1:52pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/5 "2017-06-28T13:52:44Z")
But if I don't have? For example, in my Linux servers when the log file size is 1GB it overwrite the oldest rows. Did you understand me? Thank you. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 2:09pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/6 "2017-06-28T14:09:36Z")
Well, then you'll have to use what you have in Elasticsearch. If you have the raw message stored as a field in your events in ES you can probably set up a pipeline with an elasticsearch input, the filters you need to add extra fields, and an elasticsearch output. ---
**Author:** ![joao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joao/32/83447_2.png) [@joao](https://discuss.elastic.co/u/joao)\ **Post date:** [June 28, 2017, 7:48pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/7 "2017-06-28T19:48:50Z")
Sorry, I didn't understand your explaination and how can I do this . 😕 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 7:59pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/8 "2017-06-28T19:59:15Z")
Maybe someone else has time to explain this in detail. I unfortunately don't. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2017, 7:59pm UTC](https://discuss.elastic.co/t/is-it-possible-apply-grok-in-oldest-logs/91104/9 "2017-07-26T19:59:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.