Hello,
I have seems few topics about my request but any performs...
So, i have all ELK 5.1 installed + Filebeat to send log to Logstash.
I have tested :
In logstash's conf :
Start_position => "beginning" (Invalid configuration at retstart)
Ignore_older => 0 (Invalid configuration at restart)
Exemple :
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/ssl/logstash-forwarder.crt"
ssl_key => "/etc/ssl/logstash-forwarder.key"
Start_position => "beginning"
}
}
Delete sincedb (Not perform and it wasn't recreate)
Delete All index in Elasticsearch (Ok but they is any effect).