I'm interested in using the logstash aggregate filter plugin but I was wondering how this would work in my case where I have multiple logstash nodes.
also do i need to set - filter workers to 1 ( -w 1 flag) - if I don't mind if the events are possessed out of sequence
The issue with pipeline.workers being greater than one is not just that events are processed out of sequence. An aggregate filter can sometimes cope with that just fine. The issue is that if you have multiple workers then different instances are aggregating different subsets of the data. That is also going to be case if you try to run multiple nodes. aggregate does not scale.
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.