I'm testing a simple Elastic Stack deployment to test Logstash without persistent queues. In this deployment, Logstash only gets data from Filebeats (apache logs). Both Logstash and Filebeat run fine and seem to be really resilient.
Since Filebeat ensures at-least-once delivery, I'm not sure if persistent queues are really needed. Maybe the advantage in this case is about absorbing bursts of events .
I've tried to simulate a failure scenario but I don't know how to force an abnormal termination. Logstash manages to complete the task event if it receives kill -9, kill -2 or the machine is rebooted.
Thanks very much