Make Logstash drop documents on 403

[programagor (Jiří Bednář)]

@theuntergeek

There are likely a few timestamp comparison examples here in the discussion forums. That's really all you should need.

Could you please point me at one? I seem unable to find any that would fit my situation. So I asked a new question, but no one is answering that.

Drop old messages using Ruby filter

Greetings Occasionally, my logstash receives a message from few days back, and logstash tries to write it into an index which was already marked as readonly and forcemerged. Logstash then receives a 403 error from Elasticsearch, and instead of dropping the message or placing it into DLQ, it keeps retrying it. Eventually, these undeliverable messages clog up the output queue completely, and no valid events are emitted afterwards. I submitted a bug report already, but there seems to be no activ…