Question
how to reload the skipped old files in ELK
how to reload the skipped old files in ELK and need to know where the file information
will be saved in Elasticsearch
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
×
Hi! Could you be a little more specific? Any additional information that you could provide would help us figure out your problem. How are you inputting logs into logstash? Are you using logstash-forwarder or the file input? This blog post show how you can load old logs using logstash-forwarder.
hi ,
thanks for the reply @asb ,
logstash - forwarder is using as input and i have deleted the all old data file in
elastic search inside /var/lib/elasticsearch/nodes/0/indices,while trying to reload few file using logstash - forwarder, not able load its was skipping as old file .
the configuration : Ubuntu 14.04
elasticsearch=1.1.1
kibana-3.0.1
logstash=1.4.2
logstash-forwarder_0.3.1
Logstash Forwarder configuration file
below lines in the syslog
input & filter configuration