Hey there,
does anyone know if it is possible to store data in logstash for a specific time before sending them to elasticsearch?
We need to store our log data over one day and have to send them at night through a WAN connection...
Greetings,
Toni
Not exactly 'in Logstash' but concept works.
Two Logstash configs
First Logstash config gathers all messages provided to the collector and then stores them to a file/files on the collector.
Second Logstash config runs using a cron job to read the file and then sends the data across the WAN.
I solved the problem with "elasticdump" and a crone job.
So every 24 hours the last index will be moved across the WAN to the master