I've enabled the queue.drain: true setting on one of my logstash instances which has a persistent queue.
The behavior I would expect is that when I stop the logstash process ( systemctl logstash stop ) the page files would be drained, processed and flushed.
Instead what I see is a pagefile that seems to have data in it ( wc shows several thousand lines), and when I tail the file there is what appears to be serialized input data.
Is this the expected behavior for queue.drain, or am I missing something?