# Run logs through logstash again

**URL:** <https://discuss.elastic.co/t/run-logs-through-logstash-again/26932>\
**Category:** Logstash\
**Created:** [August 5, 2015, 10:45pm UTC](https://discuss.elastic.co/t/run-logs-through-logstash-again/26932 "2015-08-05T22:45:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeroentbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeroentbt/32/5179_2.png) [@jeroentbt](https://discuss.elastic.co/u/jeroentbt)\
**Post date:** [August 5, 2015, 10:45pm UTC](https://discuss.elastic.co/t/run-logs-through-logstash-again/26932/1 "2015-08-05T22:45:04Z")

</div>

Is it possible to run logs that are in ElasticSearch through Logstash again, ideally replacing the new output in ES?

How do you normally handle changes in the pipeline? Do you just leave the old stuff as is or are you supposed to get it 100% right the first time?

I'm in the process of setting up while learning Logstash and ElasticSearch, mainly working on the logstash config, witing grok patterns and the likes.  
I would like to start processing live logs to show the management some impressive kibana graphs asap 😉

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 6, 2015, 5:44am UTC](https://discuss.elastic.co/t/run-logs-through-logstash-again/26932/2 "2015-08-06T05:44:02Z")

</div>

> Is it possible to run logs that are in Elasticsearch through Logstash again, ideally replacing the new output in ES?

There's no built-in support for this, but you can selectively delete log messages and reprocess the log files the messages once came from.

---

<div class="post-metadata">

**Author:** ![jeroentbt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeroentbt/32/5179_2.png) [@jeroentbt](https://discuss.elastic.co/u/jeroentbt)\
**Post date:** [August 6, 2015, 7:07am UTC](https://discuss.elastic.co/t/run-logs-through-logstash-again/26932/3 "2015-08-06T07:07:31Z")

</div>

Manual it is then. thx.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/run-logs-through-logstash-again/26932/4 "2017-07-06T05:32:46Z")

</div>