topic Re: What should the indexer queues be? in Getting Data In

What should the indexer queues be?

danielbb — Tue, 30 Jul 2019 12:39:00 GMT

After filling the tiny queues on the indexers, we would like to move to bigger queues.

We are thinking about the following -

[queue=AQ]
# Default maxSize = 10MB
maxSize = 200MB

[queue=aggQueue]
# Default maxSize = 1MB
maxSize = 3500MB

[queue=parsingQueue]
# Default maxSize = 6MB
maxSize = 3600MB

[queue=typingQueue]
maxSize = 2100MB

[queue=indexQueue]
maxSize = 4000MB

Does it make sense?

Re: What should the indexer queues be?

danielbb — Tue, 30 Jul 2019 14:15:37 GMT

Support said -

-- What i assume is occurring based on which Q's are full is that you have a bad regex somewhere, or for a particular source type the event breaking is not working, so for the event breaking not working, the forwarder locks onto an indexer and does not let it loadbalance as it feels it has not reached the end of the event.

And we found out that there was a weird LINE_BREAKER set for a new sourcetype. Removing it and the queues got cleared.