Logstash Cache when elasticsearch not reachable

if the elasticsearch is not reachable and data is being sent to logstash, does that data be cache by logstash until the elasticsearch is reachable?

https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#_retry_policy explains the approach the plugin takes.

Thank you for your reply @warkolm. Three questions I want to ask:

  1. I haven't enabled dead_letter_queue_enable in logstash.yml, but when the elasticsearch starts again, the data while elasticsearch isn't reachable is back. what does this if not DLQ.
  2. In case if I enable DLQ, Is there any limit on the number of events/requests that will be stored in DLQ? if yes then is it possible to configure or increase that?
  3. do i need to change logstash.yml file in all nodes of cluster for enabling DLQ?

The size of the DLQ is configurable.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.