Can anyone explain logstash's queue and dead letter queue in simple terms to me? The queue is the recorded version of the data in logstash before it is sent to Elasticsearch???
I believe the queue lies between your inputs and your filters. Any input event gets pushed on the queue to be later sent through the rest of your pipeline (filters then outptus). The DeadLetterQueue is a tool you can use to dictate what happens to events that, for example, aren't successfully sent to Elasticsearch for whatever reason. Events sent to the DeadLetterQueue get sent throught the pipeline one more time before being permanently discarded in the case for the Elasticsearch plugin (I think).
https://www.elastic.co/guide/en/logstash/current/persistent-queues.html
https://www.elastic.co/guide/en/logstash/current/dead-letter-queues.html
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.