# How does input tcp plugin handle queue being full

**URL:** <https://discuss.elastic.co/t/how-does-input-tcp-plugin-handle-queue-being-full/106222>\
**Category:** Logstash\
**Created:** [November 2, 2017, 4:39pm UTC](https://discuss.elastic.co/t/how-does-input-tcp-plugin-handle-queue-being-full/106222 "2017-11-02T16:39:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![eprothro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eprothro/32/23706_2.png) [@eprothro](https://discuss.elastic.co/u/eprothro)\
**Post date:** [November 2, 2017, 4:39pm UTC](https://discuss.elastic.co/t/how-does-input-tcp-plugin-handle-queue-being-full/106222/1 "2017-11-02T16:39:29Z")

</div>

Input plugins handle back pressure from logstash independently, however I cannot find how, specifically, the tcp input plugin handles this.

When the logstash queue is full and no longer accepting events from the tcp input plugin, what happens? Specifically, when in "server" mode, what will the client sending over TCP experience?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 3, 2017, 6:34am UTC](https://discuss.elastic.co/t/how-does-input-tcp-plugin-handle-queue-being-full/106222/2 "2017-11-03T06:34:29Z")

</div>

Eventually clients will start getting connection timeouts since Logstash won't even accept the connections.

[http://veithen.github.io/2014/01/01/how-tcp-backlog-works-in-linux.html](http://veithen.github.io/2014/01/01/how-tcp-backlog-works-in-linux.html) explains this in depth.

---

<div class="post-metadata">

**Author:** ![eprothro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eprothro/32/23706_2.png) [@eprothro](https://discuss.elastic.co/u/eprothro)\
**Post date:** [November 3, 2017, 2:23pm UTC](https://discuss.elastic.co/t/how-does-input-tcp-plugin-handle-queue-being-full/106222/3 "2017-11-03T14:23:26Z")

</div>

Thanks @magnusbaeck. To clarify, you're saying, that when the logstash queue is full:

1. The client continues to sent packets
2. The tcp input plugin continues to accept (SYN/ACK) packets until the socket backlog is full
3. The client continues to sent packets
4. The tcp input plugin begins to ignore packets (no SYN/ACK)
5. The client (probably) begins to retry transmission
6. The client (eventually) times out

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 5, 2017, 7:37pm UTC](https://discuss.elastic.co/t/how-does-input-tcp-plugin-handle-queue-being-full/106222/4 "2017-11-05T19:37:04Z")

</div>

Yes, I believe that's correct.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2017, 7:37pm UTC](https://discuss.elastic.co/t/how-does-input-tcp-plugin-handle-queue-being-full/106222/5 "2017-12-03T19:37:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.