Logstash file output - persisted queue option?

Elastic Stack Logstash
1

Hi,

I am wondering, currently I have logstash writing file output and doing ES like such

output {
    if (([type] =~ /^srx$/) and ("noelastic" not in [tags])) {
                elasticsearch
                {
                 hosts => ["hosts:9200"]
                 index => "srx-%{+YYYY.MM.dd}"
                }
        }
        if ([type] =~ /^srx$/) and ("nosavelogs" not in [tags])  {
                file {
                path => "/logstash-data/nfs-service/srx/%{host}-%{+YYYY-MM-dd}.txt"
                codec => line { format => "%{message}" }
                }
        }
}

If my NFS (purestorage flashblade) service malfunctions logstash restarts and will recreate the file structure and files on the local disk.

Is there a way to instruct logstash that if file output is obstructed or blocked to fallback to logstashes persisted queuing? this would be preferable for me as i have already designed adequate PQ disk space to be available across a number of LS servers.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.