Due to the fact that upgrade from 2.1.x to 2.2.x requires a full-cluster restart for Graylog nodes, I’m wondering does the log4j2 GELF appender (https://github.com/Graylog2/log4j2-gelf) in TCP mode keep trying to re-send the failed log messages when the Graylog servers will be down for upgrade? Unfortunately at the moment, I am unable to test this by myself for various reasons. And we don’t want to lose any log messages during the Graylog upgrade period.
Filebeat keeps sending the failed log messages until they are received by Graylog and this is an extremely valuable feature. I hope the GELF appender can handle this too.