Urgent: reparsing log files with Logstash?

Elastic Stack Logstash
1

Dear all,

Here is the context

  • OS: Linux
  • Kibana: v6.1.1
  • Elasticsearch & Logstash: v6.1.1
  • Browser: Google Chrome Version 64.0.3282.186

  • Context: we are indexing data by using Logstash and the file input plugin for .log files (persistency managed via sincedb files); due to problems on the process that provide log files, we sometimes need to reindex log files in ES from a certain period, instead of reindexing all of them (several Gb)

  • Question: is there a way to configure LS so that log files are reparsed from a certain period? we assume that our sincedb file can be updated by removing all lines from a certain INODE reference; but we faced a major problem: the reference of the INODE within the sincedb file has nothing to do with the INODE reference we get by using the ls -i command. Any hint?

Many thanks in advance.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.