Thanks so much for your suggestion.
For info I did not need to have the history of alarms. I have an application reading Elasticsearch index and this application should display alarms whenever there are entries in that index, otherwise no alarm. This index should be the copy of the remote Oracle table which should contain data only if there are alarms otherwise the table will be empty.
So my solution was to schedule logstash collection every 5 min and if there are data in remote table meaning that alarms are there, the data will be indexed to my local index and for next run the logstash will empty the index before indexing new data if there is.
In conclusion we dont need the history data but only the active alarms.
I was thinking to another solution which to collect data every 5 minutes without empty my index then create an alias on top of this index using a filter to only show newest data got during last 5 minutes then the application should read this alias.
I would like to get opinions from community to see if there is better way to fulfill this requirement.
Thanks & Regards,