By default, Logstash uses in-memory bounded queues between pipeline stages (inputs → pipeline workers) to buffer events. If Logstash experiences a temporary machine failure, the contents of the memory queue will be lost. Temporary machine failures are scenarios where Logstash or its host machine are terminated abnormally, but are capable of being restarted.
The memory queue might be a good choice if you value throughput over data resiliency.
- Easier configuration
- Easier management and administration
- Faster throughput
- Can lose data in abnormal termination
- Don’t do well handling sudden bursts of data, where extra capacity in needed for Logstash to catch up
Consider using persistent queues to avoid these limitations.
Memory queue size is not configured directly. Instead, it depends on how you have Logstash tuned.
Its upper bound is defined by
pipeline.workers (default: number of CPUs) times the
pipeline.batch.size (default: 125) events.
This value, called the "inflight count," determines maximum number of events that can be held in each memory queue.
Doubling the number of workers OR doubling the batch size will effectively double the memory queue’s capacity (and memory usage). Doubling both will quadruple the capacity (and usage).
Each pipeline has its own queue.
See Tuning and Profiling Logstash Performance for more info on the effects of adjusting
If you need to absorb bursts of traffic, consider using persistent queues instead. Persistent queues are bound to allocated capacity on disk.
These values can be configured in
- Number events to retrieve from inputs before sending to filters+workers The default is 125.
- Number of workers that will, in parallel, execute the filters+outputs stage of the pipeline. This value defaults to the number of the host’s CPU cores.
When the queue is full, Logstash puts back pressure on the inputs to stall data flowing into Logstash. This mechanism helps Logstash control the rate of data flow at the input stage without overwhelming outputs like Elasticsearch.
Each input handles back pressure independently.
Intro to Kibana
ELK for Logs & Metrics