Ok. This makes sense. So if I want to rerun logstash and populate a different index, I need to first delete a file named sincedb?
Yes, although it's not named exactly "sincedb".
The documenation says "By default, the sincedb file is placed in the home directory of the user running Logstash with a filename based on the filename patterns being watched". Where is the home directory of the user running Logstash?
For Windows I'm not sure since there's no home directory concept in the same way as on Unix-like system. I'd probably use Process Explorer on a running Logstash process to see what open files it has, or just search the file system for files with sincedb in the name.
Logstash requires either the HOME or the SINCEDB_DIR environment variable to be set, so if you can find out the value of either one for the user that Logstash runs as that's another option.
Alternatively you can set an explicit sincedb path with the sincedb_path parameter.