diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 5389ca6551b4..f4113242a7ed 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -15,9 +15,10 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] platform, and when viewed from a metadata API standpoint, it is impossible to differentiate it from OpenStack. If you know that your deployments run on Huawei Cloud exclusively, and you wish to have `cloud.provider` value as `huawei`, you can achieve this by overwriting the value using an `add_fields` processor. {pull}35184[35184] - - In managed mode, Beats running under Elastic Agent will report the package +- In managed mode, Beats running under Elastic Agent will report the package version of Elastic Agent as their own version. This includes all additional fields added to events containing the Beats version. {pull}37553[37553] +- The behavior of `queue.mem.flush.min_events` has been simplified. It now serves as a simple maximum on the size of all event batches. There are no longer performance implications in its relationship to `bulk_max_size`. {pull}37795[37795] *Auditbeat* diff --git a/libbeat/docs/queueconfig.asciidoc b/libbeat/docs/queueconfig.asciidoc index 08ece0f752f5..f06ce7039d1e 100644 --- a/libbeat/docs/queueconfig.asciidoc +++ b/libbeat/docs/queueconfig.asciidoc @@ -32,20 +32,38 @@ The memory queue waits for the output to acknowledge or drop events. If the queue is full, no new events can be inserted into the memory queue. Only after the signal from the output will the queue free up space for more events to be accepted. -The memory queue is controlled by the parameters `flush.min_events` and `flush.timeout`. If -`flush.timeout` is `0s` or `flush.min_events` is `0` or `1` then events can be sent by the output as -soon as they are available. If the output supports a `bulk_max_size` parameter it controls the -maximum batch size that can be sent. +The memory queue is controlled by the parameters `flush.min_events` and `flush.timeout`. +`flush.min_events` gives a limit on the number of events that can be included in a +single batch, and `flush.timeout` specifies how long the queue should wait to completely +fill an event request. If the output supports a `bulk_max_size` parameter, the maximum +batch size will be the smaller of `bulk_max_size` and `flush.min_events`. -If `flush.min_events` is greater than `1` and `flush.timeout` is greater than `0s`, events will only -be sent to the output when the queue contains at least `flush.min_events` events or the -`flush.timeout` period has expired. In this mode the maximum size batch that that can be sent by the -output is `flush.min_events`. If the output supports a `bulk_max_size` parameter, values of -`bulk_max_size` greater than `flush.min_events` have no effect. The value of `flush.min_events` -should be evenly divisible by `bulk_max_size` to avoid sending partial batches to the output. +`flush.min_events` is a legacy parameter, and new configurations should prefer to control +batch size with `bulk_max_size`. As of 8.13, there is never a performance advantage to +limiting batch size with `flush.min_events` instead of `bulk_max_size`. -This sample configuration forwards events to the output if 512 events are available or the oldest -available event has been waiting for 5s in the queue: +==== Synchronous mode + +In synchronous mode, an event request is always filled as soon as events are available, +even if there are not enough events to fill the requested batch. This is useful when +latency must be minimized. To use synchronous mode, set `flush.timeout` to 0. + +For backwards compatibility, synchronous mode can also be activated by setting `flush.min_events` +to 0 or 1. In this case, batch size will be capped at 1/2 the queue capacity. + +==== Asynchronous (buffered) mode + +In asynchronous mode, an event request will wait up to the specified timeout to try +and fill the requested batch completely. If the timeout expires, the queue returns a +partial batch with all available events. To use asynchronous mode, set `flush.timeout` +to a positive duration, e.g. `5s`. + +==== Example + +This sample configuration forwards events to the output when there are enough events +to fill the output's request (usually controlled by `bulk_max_size`, and limited to at +most 512 events by `flush.min_events`), or when events have been waiting for 5s without +filling the requested size: [source,yaml] ------------------------------------------------------------------------------ @@ -64,8 +82,7 @@ You can specify the following options in the `queue.mem` section of the +{beatna [[queue-mem-events-option]] ===== `events` -Number of events the queue can store. This value should be evenly divisible by `flush.min_events` to -avoid sending partial batches to the output. +Number of events the queue can store. The default value is 3200 events. @@ -73,11 +90,13 @@ The default value is 3200 events. [[queue-mem-flush-min-events-option]] ===== `flush.min_events` -Minimum number of events required for publishing. If this value is set to 0 or 1, events are -available to the output immediately. If this value is greater than 1 the output must wait for the -queue to accumulate this minimum number of events or for `flush.timeout` to expire before -publishing. When greater than `1` this value also defines the maximum possible batch that can be -sent by the output. +If greater than 1, specifies the maximum number of events per batch. In this case the +output must wait for the +queue to accumulate the requested number of events or for `flush.timeout` to expire before +publishing. + +If 0 or 1, sets the maximum number of events per batch to half the queue size, and sets +the queue to synchronous mode (equivalent to `flush.timeout` of 0). The default value is 1600. @@ -85,8 +104,7 @@ The default value is 1600. [[queue-mem-flush-timeout-option]] ===== `flush.timeout` -Maximum wait time for `flush.min_events` to be fulfilled. If set to 0s, events are available to the -output immediately. +Maximum wait time for event requests from the output to be fulfilled. If set to 0s, events are returned immediately. The default value is 10s.