Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering

Ingest model

Elastic Agent to Logstash persistent queue to {es}

Use when

Your data flow may encounter network issues, bursts of events, and/or downstream unavailability and you need the ability to buffer the data before ingestion.

Resources

Info on configuring Elastic Agent:

• Fleet and Elastic Agent Guide
• Configuring outputs for Elastic Agent

For info on Logstash plugins:

• Elastic Agent input
• Elasticsearch output plugin

For info on using Logstash for buffering and data resiliency, check out this section in the Logstash Reference:

• Logstash Persistent Queues (PQ)

Info on Elasticsearch:

• Elasticsearch Guide