2016-12-14 19:05 GMT+01:00 David Lang <[email protected]>: >> 3. imfile -> omelasticsearch is there any change a message being lost? > > > for imfile -> rsyslog, that depends on the queues (see above) > > for omeleasticsearch, that depends on the ES configuration. There are many > ways that ES could loose a message if things crash at just the wrong time...
At least some time ago (2 years?) ES did not care at all about loss. The position at least at that time was that it is a search index, not a data store. If something goes wrong, they said you should re-populate the index from your actual log store. I think the conversation is on the mailing list archive. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
