using a forwarder as a high-availability buffer?

[tedder]

I have a couple of indexers behind a heavy forwarder, which reads from a batch of ports (and a few directories). If both of the indexers go down, incoming data is dropped on the floor. Is it possible to configure my forwarder to queue messages? It's bored, since it is just doing some basic parsing and throwing data towards the indexers. I can't be the first person to consider doing this.

[gkanapathy · Accepted solution]

It is possible, but not recommended. You can review settings in outputs.conf to enable persistent queueing of data. Note that it's an especially bad idea if it's reading from files (vs transient network inputs), as the file content as well as the buffer will take up space on the machine. Also note that it's more likely for a single heavy forwarder to go down than for both a pair of indexers.

[gkanapathy]

In most cases you really ought to have the indexes.conf settings configured so that indexers can't run out of space, and should discard the oldest data when it reaches the limits. This can be difficult if you have very limited storage however and lots of indexes.

[tedder]

it's more likely that both indexers will run out of space- DAMHIK! Sort of a stampede issue- one runs out of space, so more traffic to the second causes issues. Thanks for the tips; knowing it is 'not recommended' is actually very helpful.