I am currently trialling the use of the Aggregated Filter plugin within Logstash v7.7 for a specific use case. I noticed that the description the specific Plugin (here) says:
You should be very careful to set Logstash filter workers
to 1 (
-w 1flag) for this filter to work correctly otherwise
events may be processed out of sequence and unexpected
results will occur.
I have already looked through everything under /etc/logstash and could not find anywhere where this could be specified? The closest I got was pipeline.workers in /etc/logstash/logstash.yml which is accompanied by the comment
Set the number of workers that will, in parallel, execute the filters+outputs stage of pipelines.
This defaults to the number of hosts's CPU cores.
Don't suppose this is it?
PS: I have already looked through this fairly dated thread.