Trouble sending GELF event - Graylog

[djbrunoatimix (Bruno)]

Hello guys,

Could someone help me? I am having some issue when trying to push data to Graylog.

At the moment I am testing my environment, and everything is working properly.

Filebeat -> Logstash -> Graylog -> Elasticsearch

Here are my highlights:
When I turn my Logstash instance off and few minutes later on again, Filebeat resends the data and it works fine.

When I turn my Elasticsearch instance off and few minutes later on again, Logstash resends the data and it works fine.

The problem is when I turn my Graylog off. Then my Logstash starts receiving the error:
Trouble sending GELF event ........ (MY-MESSAGE-HERE)......... :error=>#<Errno::ECONNREFUSED: Connection refused - connect(2) for "localhost" port 5041>}

This is fine, I am expecting this error to happen, but Logstash is not trying to resend the data when I turn my Graylog on again.

Could someone help me?

My Logstash Persistent Queue is also activated with the config:

------------ Queuing Settings --------------

queue.type: persisted
queue.page_capacity: 64mb
queue.max_bytes: 1024mb
queue.checkpoint.writes: 1

[djbrunoatimix (Bruno)]

Unfortunately, Logstash and Graylog will not work how I was expecting.

Logstash and Graylog can't issue an ACK sign.

The way I solved my problem was adding a RabbitMQ in the middle and configuring Logstash to send the logs to the RabbitMQ, in order to consume the messages with Graylog.