[syslog-ng] Global flush-lines option VS elasticsearch2 destination flush-limit param?

Nagy, Gábor gabor.nagy at oneidentity.com
Sun Nov 11 13:47:09 UTC 2018


Sorry for the late response.
Flush-limit() is elasticsearch() driver-specific option and AFAIK it cannot
be replaced using flush-lines() option in global-option,
and flush-lines() cannot be used as an option to elasticsearch().

However flush-lines() global option changes some underlying behaviour of
syslog-ng which can affect elasticssearch() driver as well since 3.18.1
If flush-lines option value is smaller (by default 100) than flush-limit(),
syslog-ng will flush messages once flush-lines number of messages are

Recently, we were just working on some reworking of flush-lines() in
general and regarding some drivers, e.g. http() and I think elasticsearch()
drivers are affected as well.
flush-lines() option in global options no longer affect elasticsearch()
drivers behaviour starting with upcoming 3.19.1 release.

In older releases (< 3.18.1) flush-lines() option had no effect on
elasticsearch() driver.


On Fri, Sep 28, 2018 at 9:29 AM Jose Angel Santiago <jasantiago at stratio.com>

> Hi,
> It seems both parameters are made for the same purpose, but I guess they
> don't.
> ¿Could you explain to me what is the difference between these two
> parameters?
> Thanks in advance.
> --
> | Jose Angel Santiago
> [image: Logo_signature2.png] <http://www.stratio.com/>
> Vía de las dos Castillas, 33, Ática 4, 3ª Planta
> 28224 Pozuelo de Alarcón, Madrid, Spain
> +34 918 286 473 | www.stratio.com
> <https://twitter.com/stratiobd>
> <https://www.linkedin.com/company/stratiobd>
> <https://www.youtube.com/c/StratioBD>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20181111/87e54527/attachment.html>

More information about the syslog-ng mailing list