Logstash - What happen if logstash can't contact elasticsearch node

[pjo]

Hello,

I'm new on this product

To test product, i have following setup :

• Filebeat installed on every hosts i need to send/gather logs
• Standalone logstash servers that received logs from filebeats
• Elasticsearch and Kibana on same VM.

What happen if my logstash can't deliver logs to my Elasticsearch Server ? (My ElasticSearch is down for plannned or unplanned reasons).

Is logstash able to keep logs and try to deliver them later to elasticsearch ?
If yes, could we control queue limit/size ?

Thanks

[rcowart (Rob Cowart)]

You will want to have a persistent queue configured. This is the queue between inputs and filters/outputs.

https://www.elastic.co/guide/en/logstash/current/persistent-queues.html

If the output can't reach Elasticsearch incoming data will be queued to disk up to the configured limits.