Hi everyone!
Not sure if there any answer or fix for my problem as from what I understand it’s by design but asking anyway:
Basically if I have a GELF output plugin that points to some backend (let’s say logstash) and that backend is down then graylog will (after a short time depending on the number of messages) stop processing messages (unprocessed counter increases and messages don’t show up in queries).
So basically graylog will almost depend on any targets configured for output plugins… is there a way to change this ? (as in continue to process messages even if target of output plugin is down albeit those messages will be lost and never received by the target?)
Hey there. I’m working to try and get an answer for this. I do recall that this is by design, but it’s unclear if we added an on-disk journal for the GELF output in newer versions. What version are you currently running?
Hi,
Thanks for the quick reply!
Yes you’re right I didn’t think to check the change log and we’re running quite an older one:
Version:
3.2.4+a407287, codename Ethereal Elk
I just tested with ver 4.0.10 and it behaved in the same way (it stops after ~500 messages or so and ‘unprocessed messages’ keeps increasing).
So from the conversations I’ve had with our team, neither the GELF nor the STDOUT outputs have buffers. The reason for the GELF one not having a buffer is that it’s apparently tightly coupled with the Elasticsearch output. So all that to say, the Enterprise outputs are the ones that have buffers built into them.
