I am sending logs from filebeat to logstash.
However, when I added filebeat to a new server and restarted logstash, some kind of failure caused most of the logs to be thrown away.
I would like to start logging again from the beginning. Is there something in the beats plugin of logstash like the sincedb_path in the file plugin?
Restarting logstash does not reacquire logs that have already been retrieved, right?
I don't want that to happen if all the logs are reacquired on restart.
Is there any good way to do this?
If you want to re-read a log that has already been read, does that mean you have to delete the registry?
The registry is located at registry.path if you have set it, otherwise, it is generally a file under /var/lib/filebeat/registry.
Is this correct?
For more information about the registry, see the following