indexer acknowledgment

noun

A capability that helps prevent loss of data when sending data from a forwarder to an indexer. With indexer acknowledgment, the forwarder will resend any data not acknowledged as "received" by the indexer.

Both forwarders and indexers must be at version 4.2 or higher for acknowledgment to function. Otherwise, the transmission between forwarder and indexer will proceed without acknowledgment.

Indexer acknowledgment is disabled by default, because it can affect performance.

For more information

In the Distributed Deployment Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time