I have not found any documentation on a specific question I have reference Graylog Sidecar/winlogbeat. I am trying to understand how the Sidecar/winlogbeat behaves in the following failure scenarios:
- Graylog server is reachable on the network, but not processing logs sent by the Sidecar
- Graylog server is not reachable on the network because it is down for upgrades or due to other failure
My main concern is if the Graylog server is offline for some reason, is there a potential for a “log storm” on the network in general because the sidecar keeps attempting to send and resend logs that are pending.