Logstash UDP input keeps losing data

Elastic Stack Logstash
1

Hi there,

We encountered an issue that Logstash input UDP plugin consistently losing data.

From tcpdump analysis we know the data indeed reached the VM, I also tested with Logstash file output plugin and I saw the data is missing in the output file so I can pretty sure the UDP input does not ingest all of them from host machine network stack.

I wonder if the Logstash UDP input dropped packets, do you know where can I get information on that?

Anyone has similar issue can you please educate me where is the entrypoint to fix this issue? I tried to double the UDP queue_size and pipeline.batch.size, but not ideal.

Thanks for your help!

2

UDP is not a reliable transport. By design, it will drop messages if it does not have space to buffer them. I think your only options are to increase the queue size in the logstash input or increase the buffering in the TCP stack itself.

1 Like
3

Thanks @Badger , I will try that.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.