Using the same config as in https://groups.google.com/forum/#!topic/logstash-users/qpvNK6Bz1eM
except I tried the elasticsearch output instead
I generated 1791 log lines that was shipped via lumberjack to my logstash instance. While processing I shutdown logstash:
Stdout from logstash:
In total 2069 was inserted to ES of that 1769 was unique. So I lost 22 events:
which is close to the size of LS internal queue.
Is this expected? If I send SIGTERM instead I lost 68 events.