Filebeat - Spooling to disk

Elastic Stack Beats
1

Hi Team,

What happens when a filebeat's output like ELastic Search or Logstash is not avalable , however the log files are still written. Will it start consuming memory or will it default to disk.

I see that we can configure Disk Queue (https://www.elastic.co/blog/brewing-in-beats-spooling-to-disk-in-Beats), however if I dont configure the disk Queue, will it still save events to the disk by default ?

My Filebeat version is 7.0.0

Thanks
Saket

2

Request you to please help me with this.

Thanks
Saket

3

It keeps them in memory. See: https://www.elastic.co/guide/en/beats/filebeat/master/configuring-internal-queue.html

4

Thanks for your reply.

When I shutdown logstash which is input to my filebeat, and add some logs to be parsed by filebeat, I see that the memory consumption is raised but only for some short duration. Does it release memory and sends them automatically once the logstash is up and running again? If yes, then does registry file helps in this ?