Restarting Logstash with ES input

(Joaquín Silva) #1

Hi, I have a question about what happens when you restart Logstash with ES input. It will read from the beginning of the index or it will continue from where it was?.


(Mark Walkom) #2

Depends, are you using scan/scroll or just a query?

(Joaquín Silva) #3

I'm using scroll, like this:

elasticsearch {
hosts => ""
index => "mydata-2018.09.*"
size => 500
scroll => "5m"

(Mark Walkom) #4

I don't believe we keep the scroll ID anywhere persistent, so it'd start from the beginning again.

(Joaquín Silva) #5

That are bad news.

(haritha yalavarthi) #6

Is there any other way that we can force logstash to start it from failed position . Is it possible by using query in ES input?

(system) #7