Restarting Logstash with ES input

Elastic Stack Elasticsearch
1

Hi, I have a question about what happens when you restart Logstash with ES input. It will read from the beginning of the index or it will continue from where it was?.

Regards

2

Depends, are you using scan/scroll or just a query?

3

I'm using scroll, like this:

elasticsearch {
hosts => "es.production.mysite.org"
index => "mydata-2018.09.*"
size => 500
scroll => "5m"
}

4

I don't believe we keep the scroll ID anywhere persistent, so it'd start from the beginning again.

5

That are bad news.
Thanks

6

Is there any other way that we can force logstash to start it from failed position . Is it possible by using query in ES input?