Logstash Cache when elasticsearch not reachable

Elastic Stack Logstash
1

if the elasticsearch is not reachable and data is being sent to logstash, does that data be cache by logstash until the elasticsearch is reachable?

2

https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#_retry_policy explains the approach the plugin takes.

3

Thank you for your reply @warkolm. Three questions I want to ask:

  1. I haven't enabled dead_letter_queue_enable in logstash.yml, but when the elasticsearch starts again, the data while elasticsearch isn't reachable is back. what does this if not DLQ.
  2. In case if I enable DLQ, Is there any limit on the number of events/requests that will be stored in DLQ? if yes then is it possible to configure or increase that?
  3. do i need to change logstash.yml file in all nodes of cluster for enabling DLQ?
4

The size of the DLQ is configurable.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.