Winlogbeat queuing when Logstash offline

Apologies if this has been asked before, but I have hunted around and can't find anything specific. I'm sending domain controller logs to Logstash with Winlogbeat. Windows Performance Monitor shows Winlogbeat process using 30MB memory during normal operations. If I take Logstash offline the memory use gradually climbs to 53MB, and then seems continue growing but only very slightly. I've left it for a day now. What should I expect to see if Logstash stays offline? Should resources remain flat or gradually increase?

I haven't changed anything from default other than winlogbeat.yml as follows:

  - name: Application
    ignore_older: 1h

  - name: System
    ignore_older: 1h

  - name: Security
    ignore_older: 1h

  hosts: [""]

I don't especially care if I lose logs while Logstash is offline. I'm far more concerned about not causing any resource issues on our domain controllers.

Any advice appreciated

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.