Beats: regarding backpressure

Elastic Stack Logstash
1

Hi,
What i've read on the subject of backpressure says that when logstash becomes overloaded it will apply backpressure to throttle tranmission rates from clients...

Can i ask what logstash uses as the determinant of being 'overloaded'? Is it message rates, message size, something else, or a combination of factors?

I ask because I'm seeing some (journalbeat) senders being throttled but not others. Shouldn't all senders be throttled by the beats input? The throttled sources are sending some very large messages hence my wondering whether message size is a factor here...

Regards,
David

2

Also, when the pipeline is overloaded are all clients throttled? I presume they are. I'm seeing some clients struggling to get messages through while others are fine...

3

Turned out to be client specific issues. Other events at the logstash level made it look like back-pressure might be being applied to the problem clients

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.