Deleting Logs from a single host

[plusonetech]

I was adding some additional windows servers to my log server yesterday and one of the servers I added had an auditing policy with everything enabled. The end result was in one day it logged 75GB in events, I have stopped that server from sending logs to the log server but would like to remove the logs sent by just that host yesterday. How would I go about doing this?

[cdienger]

Something like this should do the trick(change the IP as needed):

Code: Select all

curl -XDELETE 'http://localhost:9200/logstash-*/_query?q=host:192.168.5.55'

[plusonetech]

That worked perfectly, thanks for your help.

[cdienger]

Glad to hear!