It's exactly this what you need to do.  Is there any real reason (of course needed hw/virtual/storage capacity) which are needed that you haven't have indexer cluster in place? In long run indexer cluster is something which helps you to avoid this situation. Or have you already found what is the root cause to lost those events? ... View more