how often does the forwarder send data to indexer

[mgh4]

We are forwarding logs and the question has come up as to how often the forwarder sends data and is there a way to flush the data when you stop the forwarder?

I looked in etc/system/README/outputs.conf.spec but didn't find anything relating to this interval.

Thanks

[Ayn]

The forwarder sends data immediately when it becomes available. There is no certain interval that it waits or anything like that.

[mgh4]

thank you. that makes sense.

[yannK]

while tailing a file, the forwarder consider that a line is complete if an open file has not be touched for up to 3 seconds, or immediately when the lock of the file is released.

However in particular cases, if you have an application writing with a buffer or irregularly, that can cause the beginning of the line to be written, pause, then write the end, you can experience a broken event. ( turned in to 2 events)

[Ayn]

To be honest I don't know the exact behaviour here but Universal Forwarders do not perform any parsing or line breaking so they pretty much look for new data and pass it along as soon as they see it. It won't wait for a file to stop being updated.

[mgh4]

Ok, but since it can send in blocks and set source type it must be waiting at least for an end of line, or for a file to not change over some time interval. Like, send changes if file has not update in 1 second.