Logstash provides a queue.drain: true configuration setting to pause shutdown, when Logstash is stopped gracefully, until all messages from a persistent queue have been handled. Special consideration needs to be taken when using the queue.drain: true setting when using Kubernetes. By default, a Kubernetes pod has a grace period of 30 seconds to shutdown before it is closed forcefully, via a SIGKILL, which may cause Logstash to exit before the queue is fully drained.

To avoid Logstash shutting down before the queue is completely drained, we recommend setting the TerminationGracePeriodSeconds value to an artifically long period, such as 1 year, to give Logstash sufficient time to drain the queue when this functionality is required.