I am trying to find out how to view the queue so I can know whether or not I need to increase settings. Trying to fine tune this to make sure that we aren't missing any netflow data. I can compare it against our other netflow storage, but would like to start off by figuring out how big the udp input queue actually is on the logstash side of things.
If you're worried about packet loss, then you are concerned with the UDP receive buffer; this is the buffer of UDP packets that your system has received but the process bound to the port has not yet processed, and when this buffer overflows, the OS will drop incoming packets. In an ideal world will never be above zero for more than a moment or two.
Depending on your host OS, the UDP read buffer is exposed in different ways, but here's a StackOverflow answer for Linux systems: https://stackoverflow.com/a/2290848/53098
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.