UF queues when Indexer down.

[hectorvp]

Incase indexer is down or has slow speed for writing events in a disk,

I guess in these cases UFs parsing queue and output queue would be full enough and considering

dropEventsOnQueueFull = -1

 Suppose indexer was up again upon next day,

From where would UF start events, from where he had left off reading files or would drop events???

Can I consider that in metrics.log  if group=queue  and blocked=true, the IF is blocked and may drop events

Or will it send all logs when queue has space or indexer is up and running, where he had left off.

I don't have option of persistent queue bcoz I may monitor some logs files using monitor stanza

[isoutamo]

Hi

UF starts reading where it has left before output queue is full. It's own situation has stored on fishbucket index. But if you don't use persistent queues and UF will go down before it can send events to IDX then you will lost those events which are in output queue as those are just memory queues with normal configuration.

r. Ismo