Logstash v5.6.2.
I am encountering a race condition where a network monitor I'm building is passing alerts to Logstash. The issue is that I also query an Icinga Monitor every 60s in an attempt to generate a list of known alerts which Logstash can safely ignore. Therefore, I need to hold an event for 60 seconds prior to sending it through the Logstash pipeline.
Is there any way to sleep individual events for 60s to ensure my Icinga database is up to speed? Any recommendations on plugins or third party tools which could help me accomplish this?
I've attempted to use the 'sleep' plugin, however that stalls all of Logstash, which doesn't work for my use-case.