How to reuse logs in Graylog?


Thanks for your help in this basic question, but I haven’t found how the logs can be loaded as many times we wish to have a fresh load in graylog. Currently, my application is not generating enough logs for me to test changes, so I have to reuse them.

The environment includes filebeat to get the logs and GELF configuration in logstash, as well as elasticsearch and Graylog. I am attempting to create additional fields in Graylog by using extractors and Grok Patterns, but I do not have more logs to test these additional fields. How can I load again the logs in order to get the changes in Graylog?

Should I remove the index in elasticsearch, delete the registry file in filebeat and restart filebeat, elasticsearch, logstash and graylog?

Thanks for your guidance

Just to edit registry and meta.json was enough to load again the logs into Graylog.


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.