I currently have an elk cluster composed as follows:
Beats= is the agent installed in linux machine and send logs to Logstash
Logstash= filter logs and send logs to elk
-Beats --> Logstash --> Elasticsearch
my thought is: "if elk stops due to a failure the logs that beats sends to logstash where do they go?"
is it possible to enable a cache on logstash that in case the logs are not sent to elk for x reasons anyway he keeps them in a cache?