Filebeat and bufferring

Question

Sorry, if its a naive question. I've Filebeat is configured to ship data to ES directly. Just incase ES is offline and filebeat harvester found a log to ship, would it buffer, retry and ship?

here is what I tried, my docker container generated a log file, filebeat got that log entry and reported saying sent 'x' events but ES wasn't reachable. I deleted the log file thinking that filebeat got it buffered and then started ES. I dont see the logs coming thru.

How to handle this scenario?

Answer 1

如果要排队，则必须添加代理，例如kafka，redis或rabbitMQ，可以进行多种配置，如果ES停止运行，还可以发送到logstash将保留数据...如果关闭（ES），请进入日志，查看连接拒绝未发送数据