Filebeat temp location when it cant send logs

hi ,

I am using elk stack of version 7.1.1 and i read logs from the console that my docker driver prints .

Through filebeat I push them to the logstash and then to elastic but for the past 2 days due to some logstash error i'm not able to push the data to elastic so in these duration how filebeat stored all the data that it got in a bulk. Does it have any temp location to write logs untill logstash starts working again because my boot disk got raised to 82%.

After correcting the logstash configuration and deleting the old pod of filebeat now it got an reduced to 32%. So, i'm confused and unable to understand the reason behind it.

Please help me understand it.

Hi @Vamsi_Vutukuri,

I hope this helps:
https://www.elastic.co/guide/en/beats/filebeat/master/configuring-internal-queue.html#configuring-internal-queue

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.