Handling Downstream Outages with Logstash Persistent Queues
Learn how to implement Logstash persistent queues to prevent data loss during downstream outages and handle traffic spikes using disk-based buffering.
ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Learn how to implement Logstash persistent queues to prevent data loss during downstream outages and handle traffic spikes using disk-based buffering.
Stop letting slow filters throttle your data ingestion. Learn how to use Logstash's distributer pattern to isolate CPU-heavy workloads into modular pipelines.
Logstash persistent queues write events to disk before processing, absorbing traffic spikes and surviving downstream outages without data loss. Learn configuration, verification, and the trade-offs of disk-backed buffering.
Stop losing data to malformed events. Learn how to configure and manage the Logstash Dead Letter Queue (DLQ) to capture, inspect, and replay failed events.
Use Stata frames as named in-memory workspaces to isolate raw, cleaned and analysis data. Move results explicitly with frame put and frame get instead of relying on nested preserve/restore or disk tempfiles.
Logstash appears alive but stops emitting events while the persistent queue grows. This guide walks through ordered checks, root causes, and targeted fixes for stalled pipelines.
Architecture note on the smallest viable Splunk pipeline: Universal Forwarders → load-balanced Heavy Forwarder cluster → Indexers. Covers trust boundaries at the HF layer, persistent queuing configs, blocked-queue monitoring, failure-mode mitigations, and when to graduate to Indexer Clustering.
Learn how AUTOTUNE automatically tunes parallelism and prefetch depth so your GPU stays fed, with a concrete TFRecord example and a look at the trade‑offs.
Pass data between Airflow tasks with XComs—understand limits, register custom serializers, and choose between in‑memory and external storage for optimal performance.