Hi,
we are currently testing Graylog.
After the first import, we reset the Graylog server. The logs are then imported from where the import left off. Where is the timestamp stored so that we can reset it and get the imports as they were during the first import?
Thank you very much.
Best regards,
Wolfgang
That’s not happening in graylog. It’s happening on whatever agent etc you are using to send the logs to graylog, beats. Nxlog etc, they are keeping track of what they have already sent in.
There would be a way to clear that, but it depends on the software.
Hi,
we installed graylog-sidecar client:
Does anyone know where the timestamp is set?
Thank you.
Best regards,
Wolfgang
Sidecar uses the beats collectors, so you need to reset the “registry” of beats where it tracks what it has already ingested.
Sidecar installs beats in its own folders inside the sidecar install so the paths will be a little different, but generally you are trying to do this https://stackoverflow.com/questions/41703689/how-do-i-force-rebuild-logs-data-in-filebeat-5 also will depend if its filebeat or winlogbeat you are using
