LogstashTcpSocketAppender backpressure support

[ajayk74]

Hi Team,
I am using LogstashTcpSocketAppender for sending logs to centralized log server. I wanted to configure backpressure and TCP connection failure scenarios. Like i can write the logs in filesystem in case TCP socket is not available. . Please let me know how to handle this.
Thanks in advance.
Aj

[brenuart]

Hello,

Sorry but there is no such option I'm afraid.
Why not logging into a rolling file and use an external collector (ELK or Loki) to send its content to remote? The file would act as a local buffer in case the remote endpoint is not available.

[ajayk74]

Hi Bertrand Renuart,
Thanks for the reply.
Actually we are streaming the logs directly to Logstash and I only wanted to save logs in case socket not available or TCP exception.
There is a properties DEFAULT_WRITE_BUFFER_SIZE in AbstractLogstashTcpSocketAppender. I have few question on that

1. What will happen if buffer is full? will it start dropping the logs ?
2. If socket is disconnected and connected again , will it start sending the logs from it left in buffer ?

Thanks
Aj

[brenuart]

Events are first put in the internal ring buffer before they are rendered and delivered to the remote destination. This buffer can hold up to 8192 events by default but you can adjust its size using the ringBufferSize configuration property.

The appender will automatically try to reconnect when the connection is lost. In the meantime, events are enqueued in the ring buffer until a connection is reestablished. What happens when the buffer is full depends on the RingBuffer Full configuration property. The default configuration is to drop new events until some space becomes available but you can also configure it to block if you don't want to loose anything.

I would say that you should adapt the ring buffer size to match your logging rate and the expected/acceptable downtime of your remote logstash. Ideal you would also setup a second logstash instance to which the appender would connect when the first becomes unavailable (see Multiple Destinations for various strategies).

Hope this helps.

Note: the writeBufferSize controls the size of an intermediate byte buffer that sites in front on the socket output stream - it stores bytes instead of events. It is not meant to handle a temporary lost of connectivity...