Skip to content
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Set up the HTTP Client destination and its environment variables when you [set u
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
4 changes: 3 additions & 1 deletion content/en/observability_pipelines/performance.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,14 +30,16 @@ Backpressure determines if the system should slow down the consumption or accept

## In-memory buffering for components

All components in Observability Pipelines have a small in-memory buffer between them. In-memory buffering can also be configured for all Observability Pipelines destinations. The buffer is the channel that two components communicate over. It ensures that there is a small amount of space, typically 100 events, that can be used to send events even if the component on the receiving end is busy. This allows maximizing throughput when workloads are not entirely uniform.
All components in Observability Pipelines have a small in-memory buffer between them. In-memory buffering can also be configured for all Observability Pipelines destinations (in Preview). The buffer is the channel that two components communicate over. It ensures that there is a small amount of space, typically 100 events, that can be used to send events even if the component on the receiving end is busy. This allows maximizing throughput when workloads are not entirely uniform.

Buffering protects against temporary overloads or outages for a given workload. The buffering model prioritizes performance when handling an excess of events, an amount that is beyond what a destination can process, by using in-memory buffers on destinations. By default, a destination's default buffer size is increased from 100 events to 500 events. The buffer capacity is increased because destinations are typically the primary source of backpressure in any given Observability Pipelines topology. They communicate to services over the network, where latency may be introduced or outages may temporarily occur.

Observability Pipelines destination's buffers are configured to block events, which means it waits indefinitely to write to a buffer that is full. This is to make sure observability data is reliably processed in the order it was given. Additionally, as mentioned earlier, blocking induces backpressure and signals upstream components to slow down event acceptance or consumption. As a result, although the system retains all data, it accumulates at the edge.

## Disk buffers

<div class="alert alert-warning">Configuring disk buffers for destinations is in Preview.</div>

Observability Pipelines destination can be configured with disk buffers. When disk buffering is enabled for a destination, every event is first sent through the buffer and written to the data files, before the data is sent to the downstream integration. By default, data is not synchronized for every write, but instead synchronized on an interval (500 milliseconds), which allows for high throughput with a reduced risk of data loss.

## Further reading
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
1. Optionally, enter the name of the Amazon OpenSearch index. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Select an authentication strategy, **Basic** or **AWS**. For **AWS**, enter the AWS region.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ To set up the Worker's Google Chronicle destination:
- The Worker uses standard [Google authentication methods][10005].
1. Select **JSON** or **Raw** encoding in the dropdown menu.
1. Enter the log type. See [template syntax][10002] if you want to route logs to different log types based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ To use the CrowdStrike NG-SIEM destination, you need to set up a CrowdStrike dat
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
1. Enter the ARN of the IAM role you want to assume.
1. Optionally, enter the assumed role session name and external ID.
- **Note:** The [user or role you created earlier][10054] must have permission to assume this role so that the Worker can authenticate with AWS.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
1. Optionally, enter a prefix.
- Prefixes are useful for partitioning objects. For example, you can use a prefix as an object key to store objects under a particular directory. If using a prefix for this purpose, it must end in `/` to act as a directory path; a trailing `/` is not automatically added.
- See [template syntax][10051] if you want to route logs to different object keys based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
- Prefixes are useful for partitioning objects. For example, you can use a prefix as an object key to store objects under a particular directory. If using a prefix for this purpose, it must end in `/` to act as a directory path; a trailing `/` is not automatically added.
- See [template syntax][10051] if you want to route logs to different object keys based on specific fields in your logs.
1. Optionally, click **Add Header** to add metadata.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ The following fields are optional:

1. Enter the name for the Elasticsearch index. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Enter the Elasticsearch version.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ To set up the Microsoft Sentinel destination, you need to create a Workspace in
1. On the Members page, select **User, group, or service principal**.
1. Click **Select Members** and search for the application you created in the app registration step.
1. Click **Review + Assign**. **Note**: It can take up to 10 minutes for the IAM change to take effect.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
1. Select the data center region (**US** or **EU**) of your New Relic account.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
1. Optionally, enter the name of the OpenSearch index. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
1. Select your SentinelOne logs environment in the dropdown menu.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@
- `Server Certificate Path`: The path to the certificate file that has been signed by your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ The following fields are optional:
1. Enter the name of the Splunk index you want your data in. This has to be an allowed index for your HEC. See [template syntax][10051] if you want to route logs to different indexes based on specific fields in your logs.
1. Select whether the timestamp should be auto-extracted. If set to `true`, Splunk extracts the timestamp from the message with the expected format of `yyyy-mm-dd hh:mm:ss`.
1. Optionally, set the `sourcetype` to override Splunk's default value, which is `httpevent` for HEC data. See [template syntax][10051] if you want to route logs to different source types based on specific fields in your logs.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,6 @@ The following fields are optional:
1. Enter a **host name** to override the default `host` value configured for your Sumo Logic collector's source.
1. Enter a **category name** to override the default `category` value configured for your Sumo Logic collector's source.
1. Click **Add Header** to add any custom header fields and values.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,6 @@ The following destination settings are optional:
- `CA Certificate Path`: The path to the certificate file that is your Certificate Authority (CA) Root File in DER or PEM (X.509).
- `Private Key Path`: The path to the `.key` private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
1. Enter the number of seconds to wait before sending TCP keepalive probes on an idle connection.
1. Optionally, toggle the switch to enable **Buffering Options**. If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Optionally, toggle the switch to enable **Buffering Options** (in Preview). If left disabled, the maximum size for buffering is 500 events. If enabled:
1. Select the buffer type you want to set (**Memory** or **Disk**).
1. Enter the buffer size and select the unit.
Loading