# Filebeat queue.mem vs Filebeat Netflow module queue\_size

**URL:** <https://discuss.elastic.co/t/filebeat-queue-mem-vs-filebeat-netflow-module-queue-size/244403>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 10, 2020, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-queue-mem-vs-filebeat-netflow-module-queue-size/244403 "2020-08-10T13:00:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tlazarus](https://avatars.discourse-cdn.com/v4/letter/t/f6c823/32.png) [@tlazarus](https://discuss.elastic.co/u/tlazarus)\
**Post date:** [August 10, 2020, 1:00pm UTC](https://discuss.elastic.co/t/filebeat-queue-mem-vs-filebeat-netflow-module-queue-size/244403/1 "2020-08-10T13:00:17Z")

</div>

When using the Filebeat Netflow Module, there are 2 queue options - one in the primary yaml file (queue.mem) and another in the module yaml (queue\_size). What is the difference between the 2 options? I would assume that any traffic that hits the module ends up in the main memory queue, but does the module have its own buffer that is separate from the main memory buffer?

Thanks!  
Tim

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 10, 2020, 3:17pm UTC](https://discuss.elastic.co/t/filebeat-queue-mem-vs-filebeat-netflow-module-queue-size/244403/2 "2020-08-10T15:17:24Z")

</div>

Yes, The Netflow input and module is indeed has an internal queue so it can store incoming UDP packets. Its size can be configured using `queue_size`. This is completely independent of other queues in the Beat.

The other option `queue.mem` refers to the internal memory queue of Filebeat. It stores the events created in the all of the inputs. So yes, at one point your input from Netflow will end up in the memory queue, but first it goes through the queue of the input.

---

<div class="post-metadata">

**Author:** ![tlazarus](https://avatars.discourse-cdn.com/v4/letter/t/f6c823/32.png) [@tlazarus](https://discuss.elastic.co/u/tlazarus)\
**Post date:** [August 10, 2020, 3:32pm UTC](https://discuss.elastic.co/t/filebeat-queue-mem-vs-filebeat-netflow-module-queue-size/244403/3 "2020-08-10T15:32:28Z")

</div>

Is the default queue\_size documented somewhere?

Edit: according to the manifest, it is 8192.

Thanks,  
Tim

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2020, 5:32pm UTC](https://discuss.elastic.co/t/filebeat-queue-mem-vs-filebeat-netflow-module-queue-size/244403/4 "2020-09-07T17:32:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.