Under heavy logging, an application can become unresponsive about logstash-json HOT 2 CLOSED

I see. What's happening is that the message buffer before logstash sending is being filled up, causing logging to block until logs have been sent to logstash and space is available in the buffer.

This is probably a symptom of logs being produced faster than logstash can consume them, but just to make sure it's not a problem with the library: do you have any numbers on the max throughput in logs/second your logstash backend can handle, versus how much your applications were producing per second during the spike?

Assuming that the problem is a momentary spike exceeding what the backend can consume, there is not much we can do about it in the library.

We could drop log messages instead of block, but I would prefer the library to never drop messages if possible.

Another option is to have no limit on queue size, however you are then running into potential OOM-problems instead. You can try increasing the buffer_size config to something much higher to trade memory for spike tolerance.

from logstash-json.

Closing this for now. If you again encounter issues with the lib underperforming compared to volumes you know your logging backend can handle, feel free to reopen this.

from logstash-json.