Hello, I am hoping someone can help with some information.
We are trying to understand if Graylog (sidecar) has the ability to delay pushing of logs. we have scenarios where bandwidth will be limited at certain times so we would prefer to send logs between a specified time period to lower the impact (obviously not ideal as logs will be delayed but its an understood risk)
Hey @crossap,
That isn’t currently supported but could be achieved at least a couple of different ways.
From a filebeat side, see this solution where the the service is ran with the ‘once’ flag via cron. It could be an issue if the catchup takes longer than the specified time period.
Another option would be to script an api call to stop/start inputs at certain times, when the input is in a stopped state Filebeat will mark the last line sent and once the input is started will begin to send again from that point.
You could also raise a feature request.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
