You can disable listening ports so that the indexers don't receive connections from forwarders (of course if you have any local inputs defined, they will be still running; you have to disable them manually). You could also enable authentication of forwarders so that they can't connect and send anything. Remember however, that your servers will continue to ingest own longs and push them into the _internal index. If you want to keep old data, you also have to make sure it doesn't get rolled to frozen when it expires so you have to increase retention period accordingly. And I'm pretty sure that you won't be able to search your data when the license expires. ... View more