Greetings Recently I started using forcemerge on my old indices. However, I found out that occasionally, Logstash writes into the older indices, increasing the segment count, so the curator has to merge them again on the next day. To prevent this, I now switch older indices to read-only just before…

You're going to want to go with the alternative, because Logstash will never just drop documents which yield a 403 error. There are likely a few timestamp comparison examples here in the discussion forums. That's really all you should need.

Discuss the Elastic Stack

Make Logstash drop documents on 403

Elastic Stack Logstash

programagor (Jiří Bednář) October 12, 2018, 6:35am 8

Could you please point me at one? I seem unable to find any that would fit my situation. So I asked a new question, but no one is answering that.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.