The Output Isolator Pattern: Inquiry regarding downstream pipeline failures

[Kihyun_Hwang (hkh)]

I have applied the Output Isolator pattern to send logs to two ES clusters.

However, as mentioned in the reference:
"If any of the persistent queues of the downstream pipelines (in the example above, buffered-es and buffered-http) become full, both outputs will stop."

Due to this specification, in the case of a prolonged failure in one ES cluster, the queue of that pipeline may become full, causing all downstream processes to stop.

The reason for applying the isolator pattern is to ensure that even if one output fails, the remaining outputs are not affected. Is there a way to prevent other pipelines from being affected even if the downstream pipeline fails?

• logstash version : 7.17

[leandrojmp (Leandro Pereira)]

@Kihyun_Hwang

The reason for applying the isolator pattern is to ensure that even if one output fails, the remaining outputs are not affected.

But this is temporary, if you have a prolonged failure this pattern will work until the queue fills up, as you mentioned already, so you need to size up your queue accordingly.

@Kihyun_Hwang

Is there a way to prevent other pipelines from being affected even if the downstream pipeline fails?

Only if you use completely different logstash processes, if you use the same process with multiple pipelines, you will have this issue if the persisted queue fills up.

[Badger]

@Kihyun_Hwang

Is there a way to prevent other pipelines from being affected even if the downstream pipeline fails?

Yes, see this thread.