Outputs and buffering

Outputs are where events go. Every event goes to every output, and each output has its own buffer, so a slow output never holds up the others.

#HTTP

The HTTP output sends events in batches as a JSON array, compressed with gzip. A batch is sent when it is full or when flush_interval has passed, whichever comes first. Any answer in the 2xx range counts as delivered; 429 and 5xx answers are retried with backoff.

#The disk buffer

While an output cannot deliver, its events are written to the disk buffer. When the output is back they are sent in the order they arrived. The buffer is limited by buffer.max_size; when it is full, the oldest events are dropped and the count of dropped events is logged once a minute.