Hi All,
I'm using Logstash to prepare/enrich documents before they are send to Elasticsearch. The enrichment is not really optional and will have an impact later, when the data is queried. Therefore, I need to make sure that the process works and that thousands of documents are not indexed without the enrichment.
The documents are sent to Logstash via Filebeat and an HTTP service is used for the data lookup.
The problem is that I haven't found a way to stop event processing when, for example, when the HTTP service is not available.
I would prefer to just stop Logstash to prevent Filebeat from continuing to send events, which are then incompletely indexed.
Is there any way to stop Logstash with a filter or Ruby code?
Thanks!
Chris