I've got LS 6.3.1 with the following config:
path.data: /var/lib/logstash pipeline.workers: 6 pipeline.batch.size: 1000 pipeline.batch.delay: 30000 path.config: /etc/logstash/conf.d queue.type: persisted path.logs: /var/log/logstash xpack.monitoring.elasticsearch.url: ["http://eshost"] xpack.monitoring.elasticsearch.ssl.verification_mode: none xpack.monitoring.collection.interval: 10s xpack.monitoring.elasticsearch.username: "elastic" xpack.monitoring.elasticsearch.password: "xxxxxx"
the input rate is low, and I expect the new events are available in ES every 30 seconds, but the situation is: LS is waiting until a batch gets filled (1000 events - it's taking a while), and only then sending it to ES.
So, I suspect, the parameter
pipeline.batch.delay is ignored.
Is it a bug?