I am using elk stack of version 7.1.1 and i read logs from the console that my docker driver prints .
Through filebeat I push them to the logstash and then to elastic but for the past 2 days due to some logstash error i'm not able to push the data to elastic so in these duration how filebeat stored all the data that it got in a bulk. Does it have any temp location to write logs untill logstash starts working again because my boot disk got raised to 82%.
After correcting the logstash configuration and deleting the old pod of filebeat now it got an reduced to 32%. So, i'm confused and unable to understand the reason behind it.
Please help me understand it.