Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x-pack/filebeat/input/http_endpoint: add back pressure mechanism #41764

Open
efd6 opened this issue Nov 24, 2024 · 1 comment · May be fixed by #41765
Open

x-pack/filebeat/input/http_endpoint: add back pressure mechanism #41764

efd6 opened this issue Nov 24, 2024 · 1 comment · May be fixed by #41765
Assignees
Labels
bug Filebeat Filebeat Team:Security-Service Integrations Security Service Integrations Team

Comments

@efd6
Copy link
Contributor

efd6 commented Nov 24, 2024

The http_endpoint input currently has no mechanism to be able to communicate back pressure to a client. This has resulted in OoM failures in user systems when the input's outflow cannot be sufficiently rapidly ingested, due to queue memory consumption.

We can communicate back to the client that we are unable to continue to receive events by using a 429 HTTP status, but we need to be able to asses the amount of in-flight data from the client to the index. We can achieve this by watching the input metrics to keep the number of received events minus the number of ACKed events less that some value, also considering the expected size of messages from the client. It may also be possible to achieve this by keeping a running sum of in-flight message length.

Classifying this as a bug rather than a feature request since it is causing loss of service for users.

@efd6 efd6 added bug Filebeat Filebeat Team:Security-Service Integrations Security Service Integrations Team labels Nov 24, 2024
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Filebeat Filebeat Team:Security-Service Integrations Security Service Integrations Team
Projects
None yet
2 participants