Filebeat Global Configuration

The event count spool threshold. This setting forces a network flush if the number of events in the spooler exceeds the specified value.

filebeat.spool_size: 2048

See Load Balancing for more information about how this setting affects load balancing.

If enabled, the publisher pipeline in Filebeat operates in async mode preparing a new batch of lines while waiting for ACK. This option can improve load-balancing throughput at the cost of increased memory usage. The default value is false.

See Load Balancing for more information about how this setting affects load balancing.

A duration string that specifies how often the spooler is flushed. After the idle_timeout is reached, the spooler is flushed even if the spool_size has not been reached.

filebeat.idle_timeout: 5s

The name of the registry file. If a relative path is used, it is considered relative to the data path. See the Directory Layout section for details. The default is registry.

filebeat.registry_file: registry

The full path to the directory that contains additional prospector configuration files. Each configuration file must end with .yml. Each config file must also specify the full Filebeat config hierarchy even though only the prospector part of the file is processed. All global options, such as spool_size, are ignored.

The config_dir option MUST point to a directory other than the directory where the main Filebeat config file resides.

If the specified path is not absolute, it is considered relative to the configuration path. See the Directory Layout section for details.

filebeat.config_dir: path/to/configs

How long Filebeat waits on shutdown for the publisher to finish sending events before Filebeat shuts down.

By default, this option is disabled, and Filebeat does not wait for the publisher to finish sending events before shutting down. This means that any events sent to the output, but not acknowledged before Filebeat shuts down, are sent again when you restart Filebeat. For more details about how this works, see How Does Filebeat Ensure At-Least-Once Delivery?.

You can configure the shutdown_timeout option to specify the maximum amount of time that Filebeat waits for the publisher to finish sending events before shutting down. If all events are acknowledged before shutdown_timeout is reached, Filebeat will shut down.

There is no recommended setting for this option because determining the correct value for shutdown_timeout depends heavily on the environment in which Filebeat is running and the current state of the output.

Example configuration:

filebeat.shutdown_timeout: 5s