Hi Forum.
I'm just discovering how the new ELK+x-pack pieces work together, and, since I've realiced that I've got to create a parallel monitoring cluster to fully learn the current ELK potential, I'm thinking in advance of an scenario where some of my final outputs will go to the monitoring cluster.
I've read about the guaranteed output policy (or something like that... probably I've not fully understood it) and, since right now, I only have the 'production cluster' mockup up, I'm concerned that having an output pointing to a still non-reachable endpoint, is a bad thing, and eventually if an event leaks there the whole pipeline structure would choke.
Since I want to play with Logstash pipelines right now (I've read documentation today and I want to put hands on ... I'm lazy to create a monitoring cluster at this moment) I've though as an elegant, temporary solution, to configure a 'redirect to null' for everything that ends up in the output to the monitoring cluster (later, I could just change the output).
Can this be done? Since I do not see a null plugin, I've though of using the file plugin pointing to /dev/null ... is this a dumb idea? has someone tried it? I guess I'm not the first one with this in mind for sure ... what is the elegant way to achieve this? or how can I have a pipeline with a dummy output?
Thank you very much in advance.
Best regards.