Filebeat queue.mem vs Filebeat Netflow module queue_size

Elastic Stack Beats
1

When using the Filebeat Netflow Module, there are 2 queue options - one in the primary yaml file (queue.mem) and another in the module yaml (queue_size). What is the difference between the 2 options? I would assume that any traffic that hits the module ends up in the main memory queue, but does the module have its own buffer that is separate from the main memory buffer?

Thanks!
Tim

2

Yes, The Netflow input and module is indeed has an internal queue so it can store incoming UDP packets. Its size can be configured using queue_size. This is completely independent of other queues in the Beat.

The other option queue.mem refers to the internal memory queue of Filebeat. It stores the events created in the all of the inputs. So yes, at one point your input from Netflow will end up in the memory queue, but first it goes through the queue of the input.

3

Is the default queue_size documented somewhere?

Edit: according to the manifest, it is 8192.

Thanks,
Tim

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.