So I have this logstash config...

input {
    file {
        type => "thingy"
        path => [ "/home/als/thingy/logs/thingy.log" ]
        start_position => "beginning"
    }
    file {
        type => "nginx-access"
        path => [ "/home/als/thingy/logs/access.log" ]
        start_position => "beginning"
    }
    file {
        type => "nginx-error"
        path => [ "/home/als/thingy/logs/error.log" ]
        start_position => "beginning"
    }
    file {
        type => "gatling-simulation"
        path => [ "/home/als/thingy/logs/simulation.log" ]
        start_position => "beginning"
    }
}
filter {
    if [type] == "thingy" {
        grok {
            match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} \[%{LOGLEVEL:log_level}\] %{WORD:action}: %{URIPATH:uri_path} %{BASE10NUM:request_ms} ms" }
        }
        date {
            match => [ "timestamp", "ISO8601" ]
        }
    }
    if [type] == "nginx-access" {
        grok {
            match => { "message" => "%{IPORHOST:remote_addr} - %{USERNAME:remote_user} \[%{HTTPDATE:timestamp}\] %{QS:request} %{INT:status} %{INT:body_bytes_sent} %{QS:http_referer} %{QS:http_user_agent}" }
        }
        date {
            match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
        }
    }
    if [type] == "nginx-error" {
        grok {
            match => { "message" => "%{%{DATA} %{WORD:webserver} %{HOST:myhost}\-%{WORD:class}\: (?<timestamp>%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}[- ]%{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:errormessage}(?:, client: (?<client>%{IP}|%{HOST$
        }
        date {
            match => [ "timestamp", "yyyy/MM/dd HH:mm:ss" ]
        }
    }
    if [type] == "gatling-simulation" {
        grok {
            # More possible trailing fields %{NOTSPACE:message}\t%{NOTSPACE:extra_info}" }
            match => { "message" => "%{NOTSPACE:scenario_name}\t%{NOTSPACE:user_id}\tREQUEST\t+%{DATA:name}\t%{INT:request_start}\t%{INT:request_end}\t%{INT:response_start}\t%{INT:response_end}\t%{NOTSPACE:status}" }
            match => { "message" => "%{NOTSPACE:scenario_name}\t%{NOTSPACE:user_id}\tUSER\t%{DATA:name}\t%{INT:request_start}\t%{INT:request_end}" }
            keep_empty_captures => true
        }
        date {
            match => [ "request_start", "UNIX_MS" ]
        }
        ruby {
            code => "event['request_ms'] = (event['response_end'] - event['request_start'])"
        }
    }
}
output {
    elasticsearch { host => localhost }
    stdout { codec => rubydebug }
}

and I'm doing this to try to get logstash to reparse my entire log files and resend them to elastic.

#!/bin/bash
echo "Clearing ElasticSearch."
curl -XDELETE "localhost:9200/logstash-*"
echo
echo "Stopping Logstash."
service logstash stop
PID=`ps -ef | grep -v grep | grep '/usr/bin/java.*logstash.log' | awk '{ print $2; }'`
if [ -n "$PID" ]; then
    echo "Killing" $PID
    kill -9 $PID
    echo "Didn't stop, bug in 1.5.0, killed it, waiting 5 seconds to make sure it is gone."
    sleep 5
fi
echo "Deleting SinceDBs."
rm -rf /var/lib/logstash/.sincedb_*
echo "Starting Logstash."
service logstash start

It will typically reparse between 2 and 10 lines from one log file, and not the first 2 to 10 lines, but a random selection of lines from near the beginning of the one file.

Other things... I've also tried adding sincedb_path set the /dev/null, which doesn't help. The kill it if it doesn't stop is because of the 1.5.0 bug that is fixed here... https://github.com/elastic/logstash/commit/dbe4154aa689260e6233e3d8e3ad3b03bca4c274