elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
108 stars 4.93k forks source link

Logstash output mishandles acknowledgments when slow start is enabled #41695

Open faec opened 2 days ago

faec commented 2 days ago

When the Logstash output uses slow start, it sends batches to the logstash output in multiple smaller segments. The logstash client calls the acknowledgment callback (*msgRef).callback after each smaller segment is completed. However, that callback mistakenly calls batch.ACK() in that callback if there's no error, even if there are still more events left to send. This can both misreport acknowledgments for events that are still pending, and attempt to send multiple acknowledgments for the same batch, which can stall the output workers or pipeline (since acknowledgment channels are reused).

elasticmachine commented 2 days ago

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)