Remove Harvester From input File(s) - Filebeat

Elastic Stack Beats
1

I would like to re-send input path data to Elasticsearch. The data was initially sent but I deleted the filebeat-* index and would like to output the log file information to Elasticsearch again.

What are the steps/options to remove the harvester from the input file(s) and resend the data again to the output?

Regards,
Bradley

2

Filebeat stores all of its state information to a file. If you delete the file and restart Filebeat it will read the file again.

The location of the registry file is controlled by the registry_file config setting. See the docs for the details. https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#_registry_file

3

I got it!
Thanks andrewkroh for the response.
Regards.