Buffer between logstash and elasticsearch

Elastic Stack Logstash
1

Hi All,

We are using logstash tcp/udp json input plugin and the elasticsearch output plugin. I was wondering if there was a buffer of sorts between the two, so that, if the elasticsearch instance is restarted, messages are not lost.

I have read about using redis as a broker and so forth, redis seems to be installed on our server, but I can't find any association with it and logstash. I have also come across a queue depth of 20, hardcoded it seems, and was wondering if that was some kind of buffer. If so, is it persistent so that it can survive a logstash restart? and can it be increased?

Kind Regards,
Chandra

2

You need to use the redis output/input to use it with LS. So TCP/UDP > LS > Redis > LS > ES.

"Some kind" yes. Persistent, no. Increased, no.
Use Redis for now :slight_smile: