logstash的output设置为elasticsearch时,实际上logstash在向es中插入数据时也是bulk提交的,和指提交相关的设置有以下两个参数:
flush_size
Value type is number
Default value is 500
This plugin uses the bulk index API for improved indexing performance. To make efficient bulk API calls, we will buffer a certain number of events before flushing that out to Elasticsearch. This setting controls how many events will be buffered before sending a batch of events. Increasing the flush_size has an effect on Logstash’s heap size. Remember to also increase the heap size using LS_HEAP_SIZE if you are sending big documents or have increased the flush_size to a higher value.
表示多少条flush一起提交到es.
idle_flush_time
Value type is number
Default value is 1
The amount of time since last flush before a flush is forced.
This setting helps ensure slow event rates don’t get stuck in Logstash. For example, if your flush_size is 100, and you have received 10 events, and it has been more than idle_flush_time seconds since the last flush, Logstash will flush those 10 events automatically.
This helps keep both fast and slow log streams moving along in near-real-time.
表示距离上次flush的时间之后多少秒自动flush提交一次
这两个参数一起用的意思就是:
累计缓冲event条数达到flush_size值会flush一次
距离上次flush的时间之后idle_flush_time秒后也会flush一次
满足上面任意两个条件logstash都会flush提交到es