Restarting Logstash with ES input

Hi, I have a question about what happens when you restart Logstash with ES input. It will read from the beginning of the index or it will continue from where it was?.


Depends, are you using scan/scroll or just a query?

I'm using scroll, like this:

elasticsearch {
hosts => ""
index => "mydata-2018.09.*"
size => 500
scroll => "5m"

I don't believe we keep the scroll ID anywhere persistent, so it'd start from the beginning again.

That are bad news.

Is there any other way that we can force logstash to start it from failed position . Is it possible by using query in ES input?