Skip to content

[DOCS-11526] Add OP buffering options #30744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 29 commits into from
Aug 6, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
9f28f4b
add http client destination
maycmlee Jul 14, 2025
b7abb22
update http client destination
maycmlee Jul 15, 2025
6a1cdeb
update gcs auth
maycmlee Jul 15, 2025
7d74fc7
apply suggestions to gcs
maycmlee Jul 15, 2025
ac01780
update google chronicle
maycmlee Jul 15, 2025
8829610
Merge branch 'master' into may/obs-pipelines-2.7-new-components
maycmlee Jul 23, 2025
08ee092
add quotas to archives
maycmlee Jul 23, 2025
d47f2f7
add processor groups
maycmlee Jul 23, 2025
b63ce7b
add note about processor groups in preview
maycmlee Jul 23, 2025
1126cef
Apply suggestions from code review
maycmlee Jul 23, 2025
d0c85dc
update google pubsub
maycmlee Jul 24, 2025
9557df6
small update google pubsub
maycmlee Jul 24, 2025
ead38fc
update gcs integrations
maycmlee Jul 24, 2025
70e4dbc
update gcs
maycmlee Jul 24, 2025
8b5517f
Apply suggestions from code review
maycmlee Jul 24, 2025
7699312
update gcs instructions
maycmlee Jul 24, 2025
c31e986
Merge branch 'master' into may/obs-pipelines-2.7-new-components
maycmlee Jul 28, 2025
1fe02a7
add buffering options
maycmlee Jul 28, 2025
dfb1185
revery go.mod go.sum
maycmlee Jul 28, 2025
a95e41e
try revert for go files again
maycmlee Jul 28, 2025
a1eb4cf
update quota
maycmlee Jul 29, 2025
f8c8946
update quota
maycmlee Jul 29, 2025
c29af35
update processors
maycmlee Jul 30, 2025
d85fba1
merge master
maycmlee Jul 30, 2025
a2257df
get rid of go.mod
maycmlee Jul 30, 2025
3fb7c3b
Merge branch 'may/obs-pipelines-2.7-new-components' into may/op-buffe…
maycmlee Jul 30, 2025
81808a8
Merge branch 'master' into may/op-buffering-options
maycmlee Aug 1, 2025
cbcf96a
revert processor groups updates
maycmlee Aug 6, 2025
71c19c6
Merge branch 'master' into may/op-buffering-options
maycmlee Aug 6, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ Set up the HTTP Client destination and its environment variables when you [set u
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

## Set the environment variables

Expand Down
6 changes: 5 additions & 1 deletion content/en/observability_pipelines/performance.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,16 @@ Backpressure determines if the system should slow down the consumption or accept

## In-memory buffering for components

All components in Observability Pipelines have a small in-memory buffer between them. The buffer is the channel that two components communicate over. It ensures that there is a small amount of space, typically 100 events, that can be used to send events even if the component on the receiving end is busy. This allows maximizing throughput when workloads are not entirely uniform.
All components in Observability Pipelines have a small in-memory buffer between them. In-memory buffering can also be configured for all Observability Pipelines destinations. The buffer is the channel that two components communicate over. It ensures that there is a small amount of space, typically 100 events, that can be used to send events even if the component on the receiving end is busy. This allows maximizing throughput when workloads are not entirely uniform.

Buffering protects against temporary overloads or outages for a given workload. The buffering model prioritizes performance when handling an excess of events, an amount that is beyond what a destination can process, by using in-memory buffers on destinations. By default, a destination's default buffer size is increased from 100 events to 500 events. The buffer capacity is increased because destinations are typically the primary source of backpressure in any given Observability Pipelines topology. They communicate to services over the network, where latency may be introduced or outages may temporarily occur.

Observability Pipelines destination's buffers are configured to block events, which means it waits indefinitely to write to a buffer that is full. This is to make sure observability data is reliably processed in the order it was given. Additionally, as mentioned earlier, blocking induces backpressure and signals upstream components to slow down event acceptance or consumption. As a result, although the system retains all data, it accumulates at the edge.

## Disk buffers

Observability Pipelines destination can be configured with disk buffers. When disk buffering is enabled for a destination, every event is first sent through the buffer and written to the data files, before the data is sent to the downstream integration. By default, data is not synchronized for every write, but instead synchronized on an interval (500 milliseconds), which allows for high throughput with a reduced risk of data loss.

## Further reading

{{< partial name="whats-next/whats-next.html" >}}
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
1. Optionally, enter the name of the Amazon OpenSearch index. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Select an authentication strategy, **Basic** or **AWS**. For **AWS**, enter the AWS region.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

[10051]: /observability_pipelines/destinations/#template-syntax
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

**Notes**:
- When you add the Amazon Security Lake destination, the OCSF processor is automatically added so that you can convert your logs to Parquet before they are sent to Amazon Security Lake. See [Remap to OCSF documentation][10081] for setup instructions.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ To set up the Worker's Google Chronicle destination:
- The Worker uses standard [Google authentication methods][10005].
1. Select **JSON** or **Raw** encoding in the dropdown menu.
1. Enter the log type. See [template syntax][10002] if you want to route logs to different log types based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

**Note**: Logs sent to the Google Chronicle destination must have ingestion labels. For example, if the logs are from a A10 load balancer, it must have the ingestion label `A10_LOAD_BALANCER`. See Google Cloud's [Support log types with a default parser][10003] for a list of available log types and their respective ingestion labels.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ To use the CrowdStrike NG-SIEM destination, you need to set up a CrowdStrike dat
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

[10171]: https://falcon.us-2.crowdstrike.com/documentation/page/bdded008/hec-http-event-connector-guide
[10172]: /observability_pipelines/advanced_configurations/
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
<div class="alert alert-warning">Observability Pipelines compresses logs with the zstd (level 1) algorithm.</div>

There are no configuration steps for your Datadog destination.
Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@
1. Enter the ARN of the IAM role you want to assume.
1. Optionally, enter the assumed role session name and external ID.
- **Note:** The [user or role you created earlier][10054] must have permission to assume this role so that the Worker can authenticate with AWS.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

#### Example destination and log archive setup

Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
1. Enter the name of the Azure container you created earlier.
2. Optionally, enter a prefix.
1. Optionally, enter a prefix.
- Prefixes are useful for partitioning objects. For example, you can use a prefix as an object key to store objects under a particular directory. If using a prefix for this purpose, it must end in `/` to act as a directory path; a trailing `/` is not automatically added.
- See [template syntax][10051] if you want to route logs to different object keys based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

[10051]: /observability_pipelines/destinations/#template-syntax
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@
- Prefixes are useful for partitioning objects. For example, you can use a prefix as an object key to store objects under a particular directory. If using a prefix for this purpose, it must end in `/` to act as a directory path; a trailing `/` is not automatically added.
- See [template syntax][10051] if you want to route logs to different object keys based on specific fields in your logs.
1. Optionally, click **Add Header** to add metadata.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

[10051]: /observability_pipelines/destinations/#template-syntax
[10052]: https://cloud.google.com/docs/authentication#auth-flowchart
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
The following fields are optional:

1. Enter the name for the Elasticsearch index. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
2. Enter the Elasticsearch version.
1. Enter the Elasticsearch version.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

[10051]: /observability_pipelines/destinations/#template-syntax
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ To set up the Microsoft Sentinel destination, you need to create a Workspace in
1. On the Members page, select **User, group, or service principal**.
1. Click **Select Members** and search for the application you created in the app registration step.
1. Click **Review + Assign**. **Note**: It can take up to 10 minutes for the IAM change to take effect.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

The table below summarizes the Azure and Microsoft Sentinel information you need when you [set up the Observability Pipelines Microsoft Sentinel destination](#set-up-the-destination-in-observability-pipelines):

Expand Down
Original file line number Diff line number Diff line change
@@ -1 +1,4 @@
Select the data center region (**US** or **EU**) of your New Relic account.
1. Select the data center region (**US** or **EU**) of your New Relic account.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
Optionally, enter the name of the OpenSearch index. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Optionally, enter the name of the OpenSearch index. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

[10051]: /observability_pipelines/destinations/#template-syntax
Original file line number Diff line number Diff line change
@@ -1 +1,4 @@
Select your SentinelOne logs environment in the dropdown menu.
1. Select your SentinelOne logs environment in the dropdown menu.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,6 @@
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,8 @@ The following fields are optional:
1. Enter the name of the Splunk index you want your data in. This has to be an allowed index for your HEC. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Select whether the timestamp should be auto-extracted. If set to `true`, Splunk extracts the timestamp from the message with the expected format of `yyyy-mm-dd hh:mm:ss`.
1. Optionally, set the `sourcetype` to override Splunk's default value, which is `httpevent` for HEC data. See [template syntax][10051] if you want to route logs to different source types based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

[10051]: /observability_pipelines/destinations/#template-syntax
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,6 @@ The following fields are optional:
1. Enter a **host name** to override the default `host` value configured for your Sumo Logic collector's source.
1. Enter a **category name** to override the default `category` value configured for your Sumo Logic collector's source.
1. Click **Add Header** to add any custom header fields and values.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,7 @@ The following destination settings are optional:
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Enter the number of seconds to wait before sending TCP keepalive probes on an idle connection.
1. Enter the number of seconds to wait before sending TCP keepalive probes on an idle connection.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Loading