Sleep Individual Events

[sethyes]

Please post all product and debugging questions on our forum. Your questions will reach our wider community members there, and if we confirm that there is a bug, then we can open a new issue here.

Feature Request:

It would be great if the Sleep filter could sleep individual events for a given time period. I am unaware how much dev effort that would take but it would be very helpful for my use case.

Use case:https://discuss.elastic.co/t/sleep-each-individual-event/108621

[jsvd]

can you clarify what you mean by sleep individual events? this plugin will receive each event and sleep for the time specified in time => N

[sethyes]

Sleep individual log messages -- if a message comes in, it would be nice to delay it's propagation for a specified amount of time. Not stop the entire pipeline. That way all my messages could come through in the same fashion as they'd have otherwise, but with each message delayed by some configurable amount of time.

[wlbhiro]

+1

[jsvd]

Sleep individual log messages -- if a message comes in, it would be nice to delay it's propagation for a specified amount of time. Not stop the entire pipeline. That way all my messages could come through in the same fashion as they'd have otherwise, but with each message delayed by some configurable amount of time.

I see the intent here, but it creates a difficulty in acknowlegment and potential data loss. If a pipeline worker fetches a batch of 100 events from the queue, runs them through the filters + outputs but 1 message is sleeping, then the worker can't move on to the next batch due to how logstash processing works. Logstash has to acknowledge the batch back to the queue before taking the next one.