How to enable cache in logstash

Hello,

I currently have an elk cluster composed as follows:

Beats= is the agent installed in linux machine and send logs to Logstash
Logstash= filter logs and send logs to elk

-Beats --> Logstash --> Elasticsearch

my thought is: "if elk stops due to a failure the logs that beats sends to logstash where do they go?"
is it possible to enable a cache on logstash that in case the logs are not sent to elk for x reasons anyway he keeps them in a cache?

Thank you

Take a look at Queues and data resiliency | Logstash Reference [7.16] | Elastic

1 Like

thanks for your suggestion!