# Unterstanding the behaviour of grok-filter-plugin and elasticsearch-ouput-plugin

**URL:** <https://discuss.elastic.co/t/unterstanding-the-behaviour-of-grok-filter-plugin-and-elasticsearch-ouput-plugin/24038>\
**Category:** Logstash\
**Created:** [June 20, 2015, 5:37pm UTC](https://discuss.elastic.co/t/unterstanding-the-behaviour-of-grok-filter-plugin-and-elasticsearch-ouput-plugin/24038 "2015-06-20T17:37:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![user5518](https://avatars.discourse-cdn.com/v4/letter/u/3ec8ea/32.png) [@user5518](https://discuss.elastic.co/u/user5518)\
**Post date:** [June 20, 2015, 5:37pm UTC](https://discuss.elastic.co/t/unterstanding-the-behaviour-of-grok-filter-plugin-and-elasticsearch-ouput-plugin/24038/1 "2015-06-20T17:37:14Z")

</div>

Hi to everybody. I have some questions and I hope someone can help me.

I'm trying to unterstand the Grok-plugin to filter input-data. There is a option named "periodic\_flush". The documentation says "Call the filter flush method at regular interval." But I cannot figure out what is flushed. Does someone know how this option works or what is flushed?

The other "understanding-problem" belongs to the elasticsearch-plugin and the option "protocol". There are three possibilities to define a protocol: node, transport and http.  
Is it right, that when I define the protocol as a "node" that elasticsarch will store the parsed log-data but will not index it? Is the index done by logstash (which would explain the bidirectional communication which is needed)?

What exactly does the "transport"-protocol? The description in the documenation is not understandable to me.

Best regards,  
User5518

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 21, 2015, 6:25am UTC](https://discuss.elastic.co/t/unterstanding-the-behaviour-of-grok-filter-plugin-and-elasticsearch-ouput-plugin/24038/2 "2015-06-21T06:25:59Z")

</div>

Not sure what `periodic_flush` is exactly.

This might explain a bit of your second question - [https://www.elastic.co/guide/en/elasticsearch/guide/current/\_transport\_client\_versus\_node\_client.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/_transport_client_versus_node_client.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/unterstanding-the-behaviour-of-grok-filter-plugin-and-elasticsearch-ouput-plugin/24038/3 "2017-07-06T05:36:57Z")

</div>

Closed on July 6, 2017, 5:36am UTC