openstack/openstack-ansible-ops
Code Issues Proposed changes

Expose Journalbeat queue configuration

Browse Source 
Currently the settings for the internal queue in journalbeat are left at their
default settings and unchangeable. This can result in a situation whereby logs
can remain in the queue for hours if there are not enough journal events
produced to trigger a flushing of the queue. One can observe this in kibana
through a large discrepancy between the output event.created and @timestamp
fields. This commit exposes the configuration options for the in-memory queue
which is used by default in journalbeat, such that the queue flushing can be
set with more appropriate timeouts etc. This commit leaves each value at its
current default.

Change-Id: I777c68a54226045966416d12d5bba56cb7eaeb68
This commit is contained in:
Duncan Martin Walker 2020-03-30 15:35:25 +01:00
parent 4ff688dc00
commit f7fbda8c8f
2 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
elk_metrics_7x/roles/elastic_journalbeat/defaults/main.yml
View File

@ -32,3 +32,14 @@ processors: {}
# Logging level # Logging level
# Available log levels are error, warning, info, debug # Available log levels are error, warning, info, debug
journalbeat_log_level: "{{ elastic_beat_log_level | default('info') }}" journalbeat_log_level: "{{ elastic_beat_log_level | default('info') }}"
## Journalbeat event queue configuration
# Determines conditions under which the journalbeat event queue is flushed to logstash
# Max # of events the queue can buffer
journalbeat_queue_flush_max_events: 4096
# Min # of events before queue is flushed
journalbeat_queue_flush_min_events: 2048
# Max time before queue is flushed (even if queue_min_events is not reached)
journalbeat_queue_flush_timeout: 1s

10
elk_metrics_7x/roles/elastic_journalbeat/templates/journalbeat.yml.j2
View File

@ -77,25 +77,25 @@ tags:
#fields_under_root: false #fields_under_root: false
# Internal queue configuration for buffering events to be published. # Internal queue configuration for buffering events to be published.
#queue: queue:
# Queue type by name (default 'mem') # Queue type by name (default 'mem')
# The memory queue will present all available events (up to the outputs # The memory queue will present all available events (up to the outputs
# bulk_max_size) to the output, the moment the output is ready to server # bulk_max_size) to the output, the moment the output is ready to server
# another batch of events. # another batch of events.
#mem: mem:
# Max number of events the queue can buffer. # Max number of events the queue can buffer.
#events: 4096 events: {{ journalbeat_queue_flush_max_events }}
# Hints the minimum number of events stored in the queue, # Hints the minimum number of events stored in the queue,
# before providing a batch of events to the outputs. # before providing a batch of events to the outputs.
# The default value is set to 2048. # The default value is set to 2048.
# A value of 0 ensures events are immediately available # A value of 0 ensures events are immediately available
# to be sent to the outputs. # to be sent to the outputs.
#flush.min_events: 2048 flush.min_events: {{ journalbeat_queue_flush_min_events }}
# Maximum duration after which events are available to the outputs, # Maximum duration after which events are available to the outputs,
# if the number of events stored in the queue is < min_flush_events. # if the number of events stored in the queue is < min_flush_events.
#flush.timeout: 1s flush.timeout: {{ journalbeat_queue_flush_timeout }}
# The spool queue will store events in a local spool file, before # The spool queue will store events in a local spool file, before
# forwarding the events to the outputs. # forwarding the events to the outputs.