Refresh data

[mihai.radulescu]

Hello,

I have a logstash configuration that is inserting the data from csv files from a specific folder. In the past two weeks I have made numerous changes and the data that I inserted is incomplete.

How do I drop everything from elasticsearch and instruct logstash to start over?

Best Regards,
Mihai Radulescu

[aaron-nimocks]

1. Stop Logstash
2. Stack Management -> Index Management -> Delete Index
3. Stack Management -> Index Patterns -> Delete Index Pattern
4. Start Logstash

This is assuming you allow Elastic to create the mapping and don't use any templates or ingest pipelines.

[mihai.radulescu]

Hi Aaron,

Tried this however logstash didn't wanted to import any previous files, only new ones.
Also, all Dashboards needed to be re-created because new index had a different id

How can I instruct logstash to load the old files as well?

Best Regards,
Mihai Radulescu

[mihai.radulescu]

I found out that I have to also delete sincedb file (which is the file that contains the list of already parsed files).

The problem with the index pattern id was solved also. I found that I can specify the id when I create the new index pattern.