Graylog stream output with read-only indexes

[mrcdb (Marco De Benedictis)]

Hello,

I am running some Graylog instances to receive data from various sources, process them via pipelines and various extractors and send them to other components/dashboards via stream outputs (mainly transparent).

I’d like to know how does Graylog output react to indexing failures (e.g. when the available disk space is lower than a minimum threshold, and further indexing is blocked by ES read-only policy).

Is the output forwarding process performed regardless of the indexing process ? Or, does the output forwarding blocks in case of a read-only index?

Thanks for the help!

[macko003]

extractors - GL does it in processing time, if no elastic database, no processing, so GL will collect it in journal.
dashboards works with stored data, so it will use the read data from elasticsearch.
If no ES, no read, no dashboard…