Behavior of Logstash in case of crash in combination with syslog

[itspecialistsimon (Simon)]

Hi everyone,

I'm quite new to ELK and want to know Logstash's behavior when it crashs.
Assuming syslog is sending its data to Logstash and then Logstash suddenly crashs. What happens with the data syslog have already sent to Logstash?
Does Logstash something like buffering? Or are the data lost?

Thank you in advance.

Best regards,
Simon

[magnusbaeck (Magnus Bäck)]

https://www.elastic.co/guide/en/logstash/current/persistent-queues.html