Restarting Logstash with ES input


(Joaquín Silva) #1

Hi, I have a question about what happens when you restart Logstash with ES input. It will read from the beginning of the index or it will continue from where it was?.

Regards


(Mark Walkom) #2

Depends, are you using scan/scroll or just a query?


(Joaquín Silva) #3

I'm using scroll, like this:

elasticsearch {
hosts => "es.production.mysite.org"
index => "mydata-2018.09.*"
size => 500
scroll => "5m"
}


(Mark Walkom) #4

I don't believe we keep the scroll ID anywhere persistent, so it'd start from the beginning again.


(Joaquín Silva) #5

That are bad news.
Thanks


(haritha yalavarthi) #6

Is there any other way that we can force logstash to start it from failed position . Is it possible by using query in ES input?


(system) #7