# Reprocess already ingested messages

**URL:** <https://community.graylog.org/t/reprocess-already-ingested-messages/5441>\
**Category:** Graylog Central (peer support)\
**Created:** [June 1, 2018, 2:51pm UTC](https://community.graylog.org/t/reprocess-already-ingested-messages/5441 "2018-06-01T14:51:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pae23](https://avatars.discourse-cdn.com/v4/letter/p/ad7895/32.png) [@pae23](https://community.graylog.org/u/pae23)\
**Post date:** [June 1, 2018, 2:51pm UTC](https://community.graylog.org/t/reprocess-already-ingested-messages/5441/1 "2018-06-01T14:51:51Z")

</div>

Hi,

I just add new pipeline processors and I need to reprocess all (or the one matching a query) the messages already ingested.

is that possible?

Regards,

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 1, 2018, 3:11pm UTC](https://community.graylog.org/t/reprocess-already-ingested-messages/5441/2 "2018-06-01T15:11:44Z")

</div>

> [@pae23](#):
>
> is that possible?

No, that’s currently not possible.

> <https://github.com/Graylog2/graylog2-server/issues/449>
>
> In an environment where stuff changes a lot it could be very beneficial to have …the ability to re-classify messages.
> 
> One very real example is adding devices that already have existing messages in ES to a stream. Another could be the merger of 2 separate streams. A third possibility is the ability to re-run messages through an recently added extractor. 
> 
> I feel that this is a necessity for providing credibility and robustness to stream based analyses, reporting and alerting (since streams are such a vital anchor point for the way Graylog2 works).
> 
> The notion of long running system jobs already exists in Graylog2 - this would make a nice addon.
> 
> I am aware of complications, limitations, impacts, bla bla, because of the way ES works but this is rather essential because coherency and correctness are an absolute must for critical environments.
> 
> A fair compromise could be to expose this as an opt-in feature that requires clicking through 50 "I know I am stupid but I really want to do this anyways and nobody else but me is to blame" buttons and not doing this automagically upon events such as adding or modifying extractors).

> <https://github.com/Graylog2/graylog2-server/issues/736>
>
> Ive been going over graylog2 recently and couldnt find if their was a reindex op…tion. It would be nice to have with regards to extractors , so newer extractors can be applied to existing data, obviously this would need to be low priority compared to the indexing operations, but this would be really useful. Coming from a Splunk background, to an ELK (kibana) and graylog2 background, the one feature I miss is this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 15, 2018, 3:11pm UTC](https://community.graylog.org/t/reprocess-already-ingested-messages/5441/3 "2018-06-15T15:11:53Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.