Skip to content

ReOpen: filter_throttle: support retain messages if rate limit is exceeded #5357 #6839

@taka-i

Description

@taka-i

Is your feature request related to a problem? Please describe.
As stated in #5356, #5357, Throttle filter can average the transfer rate, but as soon as the rate exceeded the limit FluentBit discard messages.
In my project, all logs are related to security or auditing so I don't want to lose any of logs.
Although I use FluentBit to send logs to OpenSearch, OpenSearch can only accept certain ammount of logs in certain interval.
So OpenSearch needs rate limit by log collector otherwise it reaches its limit very easily.

Describe the solution you'd like

I want Throttle plugin retain logs feature in commited in #5356, #5357.

Describe alternatives you've considered

In Input Tail plugin, I can limit memory limit so that transfer rate can be kept under OpenSearch API bulk call rate limit.
But syslog input can not be controlled in terms of prevention from lacking logs.
( If set Receive_Buffer_Size set too low, it might cause lacking logs)

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions