You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: doc/_admin-guide/070_Destinations/155_opensearch/000_batch-mode.md
+2-20
Original file line number
Diff line number
Diff line change
@@ -8,14 +8,7 @@ description: >-
8
8
see the following section.
9
9
---
10
10
11
-
## Batch size
12
-
13
-
The `batch-bytes()`, `batch-lines()`, and `batch-timeout()` options specify how many log messages syslog-ng OSE sends in a batch. The `batch-lines()` option defines the maximum number of messages syslog-ng OSE includes in a batch in. This can be limited based on size and time:
14
-
15
-
* syslog-ng OSE sends a batch in time intervals defined by `batch-timeout()` in milliseconds, even if the number of messages in the batch is less than the amount defined in `batch-lines()`. This way the destination receives every message in a properly even if the messages cease.
16
-
* syslog-ng OSE sends a batch if the total size of the messages in the batch reaches the amount specified in `batch-bytes()` in bytes.
17
-
18
-
To increase the performance of the destination, increase the number of worker threads for the destination using the workers() option, or adjust the batch-bytes(), batch-lines(), batch-timeout() options.
11
+
{% include doc/admin-guide/batch-size.md %}
19
12
20
13
### Example: HTTP batch mode
21
14
@@ -35,18 +28,7 @@ In the following example, a batch containing 100 messages, or a maximum of 512 k
35
28
36
29
## Load balancing between multiple indexers
37
30
38
-
In syslog-ng OSE version 3.19 and later versions, multiple URLs can be specified, for example, `url("site1" "site2")`. In this case, syslog-ng OSE sends log messages to the defined URLs in a load-balanced method. This means that syslog-ng OSE forwards each message to a single URL. For example, this can be used to send the messages to a set of ingestion nodes or indexers of a SIEM solution if a single node cannot handle the load. The order of the messages arriving to the servers can differ from the order syslog-ng OSE has received them. Use load-balancing only if a server can use the timestamp from the messages. If the server uses the timestamp when it receives the messages, the resulting order of the messages is incorrect.
39
-
40
-
 **CAUTION:** If multiple URLs are set in the url() option, set the persist-name() option as well to avoid data loss.
41
-
{: .notice--warning}
42
-
43
-
In syslog-ng OSE version 3.22 and later versions, any of the following formats can be used to specify multiple URLs:
0 commit comments