persistent queue

noun

A feature that lets you store data in an input queue to files on disk. This can help prevent data loss if the forwarder or indexer gets backed up.

By default, forwarders and indexers have an in-memory input queue of 500KB. Without persistent queues, there's a potential for loss of data if the input stream overflows the in-memory queue. With persistent queues, once the in-memory queue is full, the forwarder or indexer writes the input stream to files on disk. It then processes data from the queues (in-memory and disk) until it reaches the point when it can again start processing directly from the data stream.

You enable persistent queues in inputs.conf on an input-by-input basis. Persistent queues are disabled by default.

For more information

In the Getting Data In Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time