Is there a way to configure logstash forwarder so it only retains say 5 minutes of logs if it is unable to transmit stuff to logstash? (cause it is stopped or what not)
Nope, but it's not a bad idea.
It'd be worth raising a feature request for this 
What is the process for feature requests? Where should I raise that?
Cool done
