Filebeat / logstash queue messages in peak periods -


i have single server running elasticsearch, logstash , kibana. incoming messages pushed server approximately 10 remote servers using filebeat.

traffic 10 hosts quite "bursty" , @ peak times expect incoming requests hit 100k records per minute period of 15 minutes.

my question is, if logstash cannot process 100k requests per minute filebeat start throttle or keep sending requests remote logstash server?

also, if elk server down or unavailable, messages lost or filebeat wait until elk server available again before starts sending messages?

i've looked filebeat docs , can't seem find answers these questions. pointers.

filebeat connection based service, ensures can talk server before sending logs , waits logs ack'd logstash. additionally if logstash not able keep up, beats input plugin detect 'pipeline slowdown' , tell filebeat temporarily off.

ill see if can find official references these facts.


Comments

Popular posts from this blog

sequelize.js - Sequelize group by with association includes id -

android - Robolectric "INTERNET permission is required" -

java - Android raising EPERM (Operation not permitted) when attempting to send UDP packet after network connection -