If a cluster hits watermark and gets rectified few hrs later, will there be data loss for the duration when the cluster was readonly?
If there is data lost, is there a way we can retrigger using any parameter in filebeat config.
If Filebeat is not able to write to Elasticsearch it will generally apply backpressure and stop procesing. If you are reading from files and these are not deleted during the interruption you should not lose any data. If you are using other inputs the situation may however differ and may depend on whether you have an internal disk queue configured or not.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.