I have a bunch of filebeat servers pointing to the logstash cluster via a service discovery endpoint (via consul). When I bounce the elasticsearch cluster, I usually start by stopping the filebeats, then the logstash agents, then elasticsearch; then I start elasticsearch, logstash, filebeat.
I won't be able to script the shutdown of filebeat (via service shutdown filebeat), but nevertheless I want to be able to pause it's prospecting while I bring the logstash/elasticsearch down and up.
Is there a way for me to have logstash send a "pause" response to filebeat? I don't want any data to be lost.