Refresh data

Elastic Stack Logstash
1

Hello,

I have a logstash configuration that is inserting the data from csv files from a specific folder. In the past two weeks I have made numerous changes and the data that I inserted is incomplete.

How do I drop everything from elasticsearch and instruct logstash to start over?

Best Regards,
Mihai Radulescu

2
  1. Stop Logstash
  2. Stack Management -> Index Management -> Delete Index
  3. Stack Management -> Index Patterns -> Delete Index Pattern
  4. Start Logstash

This is assuming you allow Elastic to create the mapping and don't use any templates or ingest pipelines.

3

Hi Aaron,

Tried this however logstash didn't wanted to import any previous files, only new ones.
Also, all Dashboards needed to be re-created because new index had a different id

How can I instruct logstash to load the old files as well?

Best Regards,
Mihai Radulescu

4

I found out that I have to also delete sincedb file (which is the file that contains the list of already parsed files).

The problem with the index pattern id was solved also. I found that I can specify the id when I create the new index pattern.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.