Hi, I am monitoring few log file on a windows 2012 server using im_file Send them to an ELK cluster

When checking the indexed logs we noticed delays ( 30 sec or more) for some ( not all) The only clue I have found is a bunch of this type of error

2019-01-28 14:50:01 DEBUG future event, event thread sleeping 34361ms in cond_timedwait

Any idea what that means and how to troubleshoot it ??

Many thanks Steven

Hello,

I have 2 infrastructures installed one on Amazon and another on premises. On Amazon every thing is OK, but when I send logs on premises I have a 5 to 7 minutes delayed and I loss almost 30% of the data,

I activated the buffer option and I pass through it before sending logs to my on premise server but it doesn't work

Somebody know how to correct that?

Thank you for your help and answer

Ana