We're thinking about using HEC (either Serilog Sink or Splunk SDK .Net) to log from an API, insted of developing log files and using a Universal Forwarder.
But we're highly dependant on that no data is dropped, i.e. if the HEC endpoint is unreachable for some time the solution need to buffer/cache data for the time period, and I can't seem to find any mentions about HEC buffering anywhere in the docs
So my question is does HEC offer buffering/cache capability? And in such case, how is that implemented?