Preventing / Throttling of excessive document spam from buggy forwarding agent / service

I have a scenario where a buggy service spammed about 3,000x more logs then expected and basically caused a massive cascading issue where document bulk tasks were taking 20minutes+ to process and incoming logs were just completely delayed as a result.

I am wondering, does ES have a mechanism wherein we can throttle services to X docs at a time per index even if that is something that is manually ran as a result, is there an API to do this?

Would closing an index effective kill existing write tasks and reject future documents trying to write to that index?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.