The short answer is yes - failed events are lossless so it is possible to replay these events into the pipeline to recover them.
The longer answer is that this is going to be more difficult as we don’t have a process to replay rows into nsq, or to take rows from Elasticsearch and recover them from there. It is doable but you’ll likely need custom code to:
- Query Elasticsearch and store the failed lines on disk
- Run a recovery process to play these back into NSQ in the raw format (you will need to convert the base 64 format to the collector payload format)
This also looks like quite an old pipeline as it is using the older bad events format, unfortunately all the newer tooling only works with the new format which does make recovery significantly easier.