If I disable an index, will events for that index stop being counted against the license?

[Bill_B]

This seems like a silly question, but I just want confirmation. I have a huge amount of events coming in for "ontap" index and it is causing license warnings. I would like to halt the indexing of these events until I can properly restrict the amount of events I am receiving. Will disabling the "ontap" index stop these events from being counted against the license?

Thanks.

[aholzer · Accepted solution]

Disabling an index will cause all events that are sent for that index to be dropped by the index. You will receive this error message:
"received event for unconfigured/disabled index=XYZ"

Because it stops indexing events, it will not count towards your license.

I just want to emphasize that if you disable the index you will NOT index any events sent to that index. It will drop the events and not store them anywhere. When you reenable the index, any NEW events will be indexed, and all your old events will still be available. But anything for the time while the index was disabled will not be available.

Hope this helps.

[Bill_B]

Thanks aholzer. That's exactly how I thought it would work, but wanted confirmation.

[Bill_B]

Also, any suggestions on what events to discard from NetApp: ONTAP data would be appreciated.