https://stackoverflow.com/questions/41703689/how-do-i-force-rebuild-logs-data-in-filebeat-5

  
  
sudo service filbeat stop  
  
mv /var/lib/filebeat/registry /var/lib/filebeat/registry.old  
  
sudo service filbeat start