Is there an easy way to disable indexing for a source instead of filtering to nullQueue?

[bbrubaker]

There are some situations in which we know that a certain source is going to be creating a lot of garbage data since we're running a test. So it would be ideal if we could disable indexing on this source so that we don't have to sort through all the garbage and so that the garbage isn't counted toward the license usage. I've looked into filtering to a nullQueue, and that's an option. However, it seems like somewhat of a hassle to modify two conf files any time I want to stop indexing. Has anyone run into a better way of doing this or a way to make it easier? Thanks!

[ryanoconnor]

Is there specific data in that source that is considered "garbage"? With the use of regular expressions you can usually dynamically filter out portions of events or even entire events from being indexed.

[bbrubaker]

It's more that certain tests that are run on the server create logs that would usually be useful, but when these tests are run it creates a lot of them that we don't really need. So it would be ideal if we could just turn off indexing for the source that these logs come from.

[ryanoconnor]

Having never seen the logs and not knowing much about the process here, I'll just ask if it is possible to differentiate your test case in anyway? I'll give you some high level suggestions:

• Can you run tests from a test host?
• Can you output test logs to a different file than in production?
• Do the test events contain any other unique data (test users, etc.)?

One other suggestion would be If you only wanted to modify one file, you could change the inputs.conf file to route data to a different sourcetype when you're testing and have that sourcetype always being sent to the nullQueue.