# Make Logstash drop documents on 403

**URL:** https://discuss.elastic.co/t/make-logstash-drop-documents-on-403/149977
**Category:** Logstash
**Created:** [September 26, 2018, 10:06am UTC](https://discuss.elastic.co/t/make-logstash-drop-documents-on-403/149977 "2018-09-26T10:06:15Z")
**Posts on this page:** 1
**Showing post:** 8

<div class="post-metadata">

### Author: ![programagor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/programagor/32/40183_2.png) [@programagor](https://discuss.elastic.co/u/programagor)
#### Post date: [October 12, 2018, 6:35am UTC](https://discuss.elastic.co/t/make-logstash-drop-documents-on-403/149977/8 "2018-10-12T06:35:09Z")

</div>

> [@theuntergeek](#):
>
> There are likely a few timestamp comparison examples here in the discussion forums. That's really all you should need.

Could you please point me at one? I seem unable to find any that would fit my situation. So I asked a new question, but no one is answering that.

> [@Drop old messages using Ruby filter](https://discuss.elastic.co/t/drop-old-messages-using-ruby-filter/151990):
>
> Greetings Occasionally, my logstash receives a message from few days back, and logstash tries to write it into an index which was already marked as readonly and forcemerged. Logstash then receives a 403 error from Elasticsearch, and instead of dropping the message or placing it into DLQ, it keeps retrying it. Eventually, these undeliverable messages clog up the output queue completely, and no valid events are emitted afterwards. I submitted a bug report already, but there seems to be no activ…

---

_[View the full topic](https://discuss.elastic.co/t/make-logstash-drop-documents-on-403/149977)._