Disabling Ingestion

LogScale has the ability to pause ingestion of data into a repository when needed.

There are a few reasons to consider blocking ingest:

  • the data arriving is corrupt or otherwise causing problems.

  • to prevent new data from arriving before you update the parser syntax.

  • in the case of a cluster, you may want to do this if the volume of data arriving is overwhelming your current cluster size. Ingestion could be disabled until you have time to resolve the problem.

Blocking and Unblocking Ingestion

Security Requirements and Controls

Ingest can be blocked and unblocked from the user interface. You can specify for how long you want to prevent new events from being ingested for a specific repository.

Screenshot of the LogScale Block Ingestion settings interface showing configuration options for temporarily pausing data ingestion to a repository. The interface displays a duration selector where administrators can specify how long ingestion should be blocked before automatically resuming, with options ranging from minutes to days. This administrative panel includes a prominent 'Block ingestion' button that, when clicked, will immediately halt new data from entering the repository for the specified period. The interface allows system administrators to temporarily stop data flow when troubleshooting issues with incoming data or when preparing to update parser configurations.

Figure 82. Blocking Ingest-Settings


The Block Ingestion page enables you to temporarily block ingestion for a short period of time, after which it will be re-enabled. This can be useful in a variety of situations where the level of ingestion and activity are causing performance or reporting problems.

  1. From the Repositories and Views page, select the repository where you want to block ingestion.

  2. Click Settings, under Ingest on the side menu click Block ingest.

  3. On the Block ingestion page, select the interval of time for which to block ingest and click Block ingestion or click Unblock to restart ingestion.

If you are using a log shipper, once ingestion is enabled they can reconnect and continue sending the logs so that events are not lost.

For more information, see Disabling Ingestion.

If successful, you will see a notice:

Screenshot of the LogScale user interface showing a confirmation message that ingestion has been blocked for a repository. The interface displays a notification banner with status information about the block, including the duration for which ingestion will remain disabled and when it will automatically resume. This confirmation appears after a user has successfully configured ingestion blocking from the Block Ingestion settings page.

Figure 83. Blocking Ingest


Note

When the duration of the block expires, ingest is re-enabled. The maximum duration allowed is one year.

When you block ingest, all sockets opened for ingest into this repository are closed and not re-opened until the block has expired or been removed by hand. Most log shippers will simply queue up the log records when they cannot deliver them and then, when the connection is re-opened, they will ship all the missing data as well as new data from that point on.