I see flush_Size & max_retry_item default count as 5000.
what this 5000 means? 5000 bytes? 5000 log count ?
Quoting the flush_size documentation, emphasis mine:
This setting controls how many events will be buffered before sending a batch of events.
The documentation of retry_max_items isn't quite as explicit, but given the name of the parameter I think it's safe to assume that's it's the number of events there too.
flush_size I understand. I don't exactly get what is idle_flush_time. The documentation I have read. But still, it's not very clear.
Hi @lucifer ,
idle_flush_time guarantees that your events from Logstash are sent periodically to Elasticsearch. If the number of events is low in logstash, it might take very long before the flush_size is reached. This would cause that those events are sent to Elasticsearch (too) late. Using idle_flush_time you can set a time since the last flush after which the events are flushed, even if the flush_size has not been reached. When the flush_size is reached before the idle_flush_time, the events are also flushed to Elasticsearch.