I installed Logstash to parse apache files. It took me quite q while to get the settings right and I always tried on real logs. I noticed (as the documentation says) that logstash "remembers" where it was in a file. Now my setings are Ok and I would like Logstash to "forget". This seems harder than I though. I already did the following:
used:
start_position => "beginning"
deleted the complete "data" folder from elastissearch (and stopped it first)
looked at which files where opened by logstash with
lsof -p PID
and deleted everything which was promising (in my case/tmp/jffi*.tmp
)
Still Logstash does not forget and parse only "fresh" files in the folder where the logs are
Any ideas?