Refresh data

mihai.radulescu · December 17, 2020, 12:36pm

Hello,

I have a logstash configuration that is inserting the data from csv files from a specific folder. In the past two weeks I have made numerous changes and the data that I inserted is incomplete.

How do I drop everything from elasticsearch and instruct logstash to start over?

Best Regards,
Mihai Radulescu

aaron-nimocks · December 17, 2020, 1:05pm

Stop Logstash
Stack Management -> Index Management -> Delete Index
Stack Management -> Index Patterns -> Delete Index Pattern
Start Logstash

This is assuming you allow Elastic to create the mapping and don't use any templates or ingest pipelines.

mihai.radulescu · December 18, 2020, 7:33am

Hi Aaron,

Tried this however logstash didn't wanted to import any previous files, only new ones.
Also, all Dashboards needed to be re-created because new index had a different id

How can I instruct logstash to load the old files as well?

Best Regards,
Mihai Radulescu

mihai.radulescu · December 18, 2020, 9:03am

I found out that I have to also delete sincedb file (which is the file that contains the list of already parsed files).

The problem with the index pattern id was solved also. I found that I can specify the id when I create the new index pattern.

system · January 15, 2021, 9:03am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.