Loading dumped non-parsed ES data to Logstash

Elastic Stack Logstash
1

I have data in Elasticsearch that was sent by Filebeat to Elasticsearch without being parsed in Logstash, also I have a dump of this data using Elasticdump (indexes and mappings as jsons).

I need to parse these logs in Logstash. Is there a way to parse batch data which already exists in Elasticsearch?

My current dataflow looks like this:
Filebeat -> Kafka/zookeeper -> Logstash -> Elasticsearch -> Kibana

I tried to run a Kafka producer and send the Jsons I have already but they were fully received under "message" field, while disregarding other important fields.

Is there a way to ingest them into my cluster while parsing them again (backfilling) ? or a way to parse batch data which exist in ES using Logstash?

Thanks:)

2

There's an elasticsearch input that you can use.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.