# How to increase the data sent out by logstash forwarder

**URL:** <https://discuss.elastic.co/t/how-to-increase-the-data-sent-out-by-logstash-forwarder/32741>\
**Category:** Logstash\
**Created:** [October 22, 2015, 4:43am UTC](https://discuss.elastic.co/t/how-to-increase-the-data-sent-out-by-logstash-forwarder/32741 "2015-10-22T04:43:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arunjohn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arunjohn/32/4874_2.png) [@arunjohn](https://discuss.elastic.co/u/arunjohn)\
**Post date:** [October 22, 2015, 4:43am UTC](https://discuss.elastic.co/t/how-to-increase-the-data-sent-out-by-logstash-forwarder/32741/1 "2015-10-22T04:43:16Z")

</div>

I currently see the following from the logstash-forwarder logs :

> 2015/10/19 04:42:01.697852 --- options -------  
> 2015/10/19 04:42:01.697913 config-arg: /etc/logstash-forwarder.conf  
> 2015/10/19 04:42:01.697925 idle-timeout: 5s  
> 2015/10/19 04:42:01.697930 spool-size: 1024  
> 2015/10/19 04:42:01.697934 harvester-buff-size: 16384  
> 2015/10/19 04:42:01.697937 --- flags ---------  
> 2015/10/19 04:42:01.697941 tail (on-rotation): false  
> 2015/10/19 04:42:01.697945 log-to-syslog: false  
> 2015/10/19 04:42:01.697949 quiet: false  
> 2015/10/19 04:42:01.698390 {  
> "network": {  
> "servers": ["10.0.0.7:5000"],  
> "timeout": 15,  
> "ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt"  
> },  
> "files": [  
> {  
> "paths": ["/var/log/squid/\*"],  
> "fields": { "type": "squid" }  
> }  
> ]  
> }

> 2015/10/19 06:58:34.397528 Registrar: processing 1024 events  
> 2015/10/19 06:58:34.870352 Registrar: processing 1024 events  
> 2015/10/19 06:58:35.323514 Registrar: processing 1024 events  
> 2015/10/19 06:58:35.802681 Registrar: processing 1024 events  
> 2015/10/19 06:58:36.345547 Registrar: processing 1024 events

My questions are as follows:

1. How can I increase the 1024 value ?
2. What are the implications or consequences if me make such changes ?
3. What are the limits or maximum value that can be configured ?

My current ELK stack is configured as follows:

Logstash-forwarder \> Logstash \> Elasticsearch \< Kibana.

Also do I have to make any changes to the Logstash receiver to accommodate the incoming volume of data ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 22, 2015, 6:14am UTC](https://discuss.elastic.co/t/how-to-increase-the-data-sent-out-by-logstash-forwarder/32741/2 "2015-10-22T06:14:07Z")

</div>

> 1. How can I increase the 1024 value ?

Use the `-spoolsize` command-line option.

What are you trying to accomplish? You're only flushing about twice a second with the default settings so I doubt the overhead of flushing is killing your performance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/how-to-increase-the-data-sent-out-by-logstash-forwarder/32741/3 "2017-07-06T05:25:48Z")

</div>