# Put an intentional delay in event transmission to Logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 30, 2017, 5:53pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813 "2017-11-30T17:53:08Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [November 30, 2017, 5:53pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/1 "2017-11-30T17:53:08Z")
I have a use-case where I want to delay individual events being transmitted via Filebeat to Logstash. This is due to a race condition I'm encountering with another monitoring mechanism. I've looked through the config options for Filebeat and haven't seen an option similar to this. Does anyone know if this functionality is possibly native to Filebeat or if it's on the development roadmap? ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [November 30, 2017, 6:10pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/2 "2017-11-30T18:10:42Z")
Hi, Have you thought about using a message broker (Redis or alike) between Filebeat and Logstash in aid of some level of buffering? ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [November 30, 2017, 8:47pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/3 "2017-11-30T20:47:15Z")
I have considered using a message queue, however I'm trying to limit the number of services I have to rely on for this data pipeline. Thanks for your suggestion. I suppose I'm pivoting towards creating a python script that will delay messages for 60s. ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [November 30, 2017, 10:15pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/4 "2017-11-30T22:15:13Z")
@seth.yes As well as scripting something timely, do consider the parameters that come with filebeat. close\_inactive or scan\_frequency. Backoff and harvester\_buffer\_size may be worth reading and testing with as well. All documented here: [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html) ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [November 30, 2017, 11:21pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/5 "2017-11-30T23:21:46Z")
Thanks for the suggestion. I did review the capabilities of Filebeat -- I appreciate you bringing these options up but none of them really fit my use-case. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [December 3, 2017, 9:55am UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/6 "2017-12-03T09:55:51Z")
Can you share some more details on what you try to do? Do you try to "delay" a message, meaning if a line is read at time x, it should be sent 2s later. Or are you trying to throttle a limit the number of events? Or something else? ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [December 5, 2017, 10:50pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/7 "2017-12-05T22:50:25Z")
I'm simply trying to put a delay in a message: Once any one message is received, I'd like Logstash to sleep on pushing that one message through the filter for 60 seconds. Any one message would then be passed through my Logstash filter approximately 60 seconds after it was put into the file being tailed by Filebeat. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/8 "2017-12-06T13:53:28Z")
The closest thing I can think of is the `sleep` filter in logstash. ---
**Author:** ![seth.yes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seth.yes/32/11788_2.png) [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Post date:** [December 6, 2017, 4:24pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/9 "2017-12-06T16:24:40Z")
`Sleep` filter definitely does not do what I need. Sleep filter pauses the entire pipeline for the specified duration, effectively blocking any throughput. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 3, 2018, 4:25pm UTC](https://discuss.elastic.co/t/put-an-intentional-delay-in-event-transmission-to-logstash/109813/10 "2018-01-03T16:25:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.