Refresh data


I have a logstash configuration that is inserting the data from csv files from a specific folder. In the past two weeks I have made numerous changes and the data that I inserted is incomplete.

How do I drop everything from elasticsearch and instruct logstash to start over?

Best Regards,
Mihai Radulescu

  1. Stop Logstash
  2. Stack Management -> Index Management -> Delete Index
  3. Stack Management -> Index Patterns -> Delete Index Pattern
  4. Start Logstash

This is assuming you allow Elastic to create the mapping and don't use any templates or ingest pipelines.

Hi Aaron,

Tried this however logstash didn't wanted to import any previous files, only new ones.
Also, all Dashboards needed to be re-created because new index had a different id

How can I instruct logstash to load the old files as well?

Best Regards,
Mihai Radulescu

I found out that I have to also delete sincedb file (which is the file that contains the list of already parsed files).

The problem with the index pattern id was solved also. I found that I can specify the id when I create the new index pattern.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.