we are using logstash with persistent queue feature enabled and the following setup:
filebeat ---> logstash (with PQ) ---> elasticsearch
Now we are moving to a kafka based setup like that:
filebeat ---> kafka ----> logstash ---> elasticsearch
In this kind of setup, I think we still neet PQ enabled in order to avoid data loss, right?