Hello @keyolk
I am a bit suprised that the windows size is always 1, because that would mean that the filebeat has really low trafic or something else is off.
Before we go deeper in the debugging could you provide the following information:
The filebeat process launched in docker container, with NATed network with 5 of output logstash hosts.
At the begining it has 5 of established connection with logstash.
Single line of log sent to logstash, then window size become 15 from the initial window size 10, And MaxOkWindowSize also become 10.
Several hours later(conntracks tcp established timeout, or logstash idle timeout) without incoming log, connection to logstash is disconnected but socket is still opened.
After getting new single line of log. filebeat fails to send 5 times, windowSize shrinks to 1.
Reopen connection, succeed to send log.
Now windowSize is 1 and maxOkWindowSize is 2.
Again several hours pass, it fails again.
Now windowSize and maxOkWindowSize become 1.
It never be changed without TTL (seems it is available from v 6.0)
We use filebeat version 5.4.2 with below output configuration.
Thanks @pierhugues I checked recent changes,
Seems with default configuration the issue is not be reproduced.
Only with setting "slow_start=true" it can make same situation again.
Is the "slow_start mode" will be deprecated in the future ?
Good to hear that, concerning slow start we do not have plan to deprecated in the short term, but it's not really anymore because Logstash and Beats supports partial ACKs, so LS doesn't need to ACK the full window.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.