Hi, well the only input is syslogng via tcp, so if I understand correctly messages should not be lost, right?
As far as I know syslog-ng will hold any pending messages.
I'm not familiar with syslog-ng's behavior in those cases. It obviously also depends on the duration of the Logstash outage.
So... logstash checks the availability of the output before accepting any messages from the input?
If this is not the case, what happens if a messages has been received but then the output is not available?
Logstash has an internal queue of 20 items. If the queue is full, inputs that want to submit message block. For file inputs this simply means that they stop reading from the input file, and for TCP and UDP inputs it eventually means that they'll stop accepting connections/messages.
Items already in the queue will eventually be flushed, unless Logstash is shut down. If that happens the queued messages will be lost.