Hi,
Thanks for your help in this basic question, but I haven’t found how the logs can be loaded as many times we wish to have a fresh load in graylog. Currently, my application is not generating enough logs for me to test changes, so I have to reuse them.
The environment includes filebeat to get the logs and GELF configuration in logstash, as well as elasticsearch and Graylog. I am attempting to create additional fields in Graylog by using extractors and Grok Patterns, but I do not have more logs to test these additional fields. How can I load again the logs in order to get the changes in Graylog?
Should I remove the index in elasticsearch, delete the registry file in filebeat and restart filebeat, elasticsearch, logstash and graylog?
Thanks for your guidance