How does input tcp plugin handle queue being full

Elastic Stack Logstash
1

Input plugins handle back pressure from logstash independently, however I cannot find how, specifically, the tcp input plugin handles this.

When the logstash queue is full and no longer accepting events from the tcp input plugin, what happens? Specifically, when in "server" mode, what will the client sending over TCP experience?

2

Eventually clients will start getting connection timeouts since Logstash won't even accept the connections.

http://veithen.github.io/2014/01/01/how-tcp-backlog-works-in-linux.html explains this in depth.

3

Thanks @magnusbaeck. To clarify, you're saying, that when the logstash queue is full:

  1. The client continues to sent packets
  2. The tcp input plugin continues to accept (SYN/ACK) packets until the socket backlog is full
  3. The client continues to sent packets
  4. The tcp input plugin begins to ignore packets (no SYN/ACK)
  5. The client (probably) begins to retry transmission
  6. The client (eventually) times out
4

Yes, I believe that's correct.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.