Logstash pipeline blocks every write if one index isn't available

Hi,

My issue is that when I receive an event with a timestamp that's in the past, which would be written to the previous date-based index, it'll be blocked due to frozen state. However, that prevents every other event (the majority) from indexing too. I lost millions of current events during the weekend because there were some old ones that couldn't be indexed. While I obviously need to weed out the root issue, I'm wondering how I can avoid this issue.
Is there any way to redirect events that are "too old" to process the normal way to a "dummy" index? Or any other scenario where I still can freeze my old indices?

Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.