# Disabling a Source from processing

**URL:** <https://community.graylog.org/t/disabling-a-source-from-processing/4985>\
**Category:** Graylog Add-ons\
**Created:** [April 16, 2018, 12:47pm UTC](https://community.graylog.org/t/disabling-a-source-from-processing/4985 "2018-04-16T12:47:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ariv1983](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ariv1983/32/1709_2.png) [@Ariv1983](https://community.graylog.org/u/Ariv1983)\
**Post date:** [April 16, 2018, 12:47pm UTC](https://community.graylog.org/t/disabling-a-source-from-processing/4985/1 "2018-04-16T12:47:37Z")

</div>

Hi Team,

I have configured around 6 source server and the message are getting processed fine. My storage is not sufficient to store all the server’s log message so I would like to disable couple of Source servers from sending the log message to Graylog server.

Is there a way to disable the Source servers from Graylog itself? Or I have to disable from the Log4j file in the source server, and requires to restart the server which I don’t want.

Please advice.

Thanks,  
Ariv

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [April 16, 2018, 1:03pm UTC](https://community.graylog.org/t/disabling-a-source-from-processing/4985/2 "2018-04-16T13:03:01Z")

</div>

Hej Ariv,

you could always write a processing pipeline rule to drop messages with a give source.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [April 16, 2018, 1:16pm UTC](https://community.graylog.org/t/disabling-a-source-from-processing/4985/3 "2018-04-16T13:16:35Z")

</div>

> [@Ariv1983](#):
>
> Or I have to disable from the Log4j file in the source server, and requires to restart the server which I don’t want.

This would be the preferred solution: Configure the clients so they don’t send anything in the first place and thus saving processing time and network bandwidth.

Besides dropping the messages in Graylog itself, you could also use a packet filter such as Netfilter (iptables) to reject or drop messages from certain network hosts and thus saving processing time on the side of Graylog.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 30, 2018, 1:20pm UTC](https://community.graylog.org/t/disabling-a-source-from-processing/4985/4 "2018-04-30T13:20:39Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.