Is there a way to accurately determine the volume of events being dropped to the nullQueue?

[staftly]

Is there a way to accurately determine the volume of events being dropped to the nullQueue?

I have a standard props & transforms setup to drop events for a given source type by a single regex entry.

Any help would be appreciated.

Many thanks
Staftly

[dflodstrom]

There are many ways to go about this.

One way is to just send the events to an index instead of to the nullQueue, then examine the size of that index and delete it if you want.

You could baseline the size of your index over a period of time with and without the filter as well.

If you're reading in static set of data you could easily index it, check the size, delete the index and re-index with your filter.

You can always go over your license for one day if you needed to.