# Filebeat at least once delivery and udp input

**URL:** <https://discuss.elastic.co/t/filebeat-at-least-once-delivery-and-udp-input/208774>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 20, 2019, 8:41pm UTC](https://discuss.elastic.co/t/filebeat-at-least-once-delivery-and-udp-input/208774 "2019-11-20T20:41:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [November 20, 2019, 8:41pm UTC](https://discuss.elastic.co/t/filebeat-at-least-once-delivery-and-udp-input/208774/1 "2019-11-20T20:41:45Z")

</div>

I'm wondering if and how Filebeat can guarantee at least once delivery with an udp input? If we would restart Filebeat, will Palo Alto logs send to it, get lost?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 20, 2019, 8:56pm UTC](https://discuss.elastic.co/t/filebeat-at-least-once-delivery-and-udp-input/208774/2 "2019-11-20T20:56:08Z")

</div>

It can only guarantee delivery of what it receives, not everything that is sent over UDP as UDP does not offer any delivery guarantees. If the listening process was shut down or restarted logs could be lost. If you want to avoid data loss - avoid UDP.

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [November 21, 2019, 7:02am UTC](https://discuss.elastic.co/t/filebeat-at-least-once-delivery-and-udp-input/208774/3 "2019-11-21T07:02:10Z")

</div>

@Christian_Dahlqvist  
But the Palo Alto module only allows udp.....

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 22, 2019, 6:18am UTC](https://discuss.elastic.co/t/filebeat-at-least-once-delivery-and-udp-input/208774/4 "2019-11-22T06:18:35Z")

</div>

Then I guess there is no way to completely avoid data loss or guarantee delivery to Filebeat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2019, 6:18am UTC](https://discuss.elastic.co/t/filebeat-at-least-once-delivery-and-udp-input/208774/5 "2019-12-20T06:18:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.