Hello!

Sorry for the late response.

Flush-limit() is elasticsearch() driver-specific option and AFAIK it cannot be replaced using flush-lines() option in global-option,

and flush-lines() cannot be used as an option to elasticsearch().

However flush-lines() global option changes some underlying behaviour of syslog-ng which can affect elasticssearch() driver as well since 3.18.1 release.

If flush-lines option value is smaller (by default 100) than flush-limit(), syslog-ng will flush messages once flush-lines number of messages are collected.

Recently, we were just working on some reworking of flush-lines() in general and regarding some drivers, e.g. http() and I think elasticsearch() drivers are affected as well.

flush-lines() option in global options no longer affect elasticsearch() drivers behaviour starting with upcoming 3.19.1 release.

In older releases (< 3.18.1) flush-lines() option had no effect on elasticsearch() driver.

Regards,

Gabor

On Fri, Sep 28, 2018 at 9:29 AM Jose Angel Santiago <jasantiago@stratio.com> wrote:

Hi,

It seems both parameters are made for the same purpose, but I guess they don't.

¿Could you explain to me what is the difference between these two parameters?

Thanks in advance.

--

| Jose Angel Santiago

Vía de las dos Castillas, 33, Ática 4, 3ª Planta
28224 Pozuelo de Alarcón, Madrid, Spain
+34 918 286 473 | www.stratio.com

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq