Logstash - What happen if logstash can't contact elasticsearch node

Elastic Stack Logstash
1

Hello,

I'm new on this product

To test product, i have following setup :

  • Filebeat installed on every hosts i need to send/gather logs
  • Standalone logstash servers that received logs from filebeats
  • Elasticsearch and Kibana on same VM.

What happen if my logstash can't deliver logs to my Elasticsearch Server ? (My ElasticSearch is down for plannned or unplanned reasons).

Is logstash able to keep logs and try to deliver them later to elasticsearch ?
If yes, could we control queue limit/size ?

Thanks

2

You will want to have a persistent queue configured. This is the queue between inputs and filters/outputs.

https://www.elastic.co/guide/en/logstash/current/persistent-queues.html

If the output can't reach Elasticsearch incoming data will be queued to disk up to the configured limits.