Hi, I am monitoring few log file on a windows 2012 server using im_file Send them to an ELK cluster When checking the indexed logs we noticed delays ( 30 sec or more) for some ( not all) The only clue I have found is a bunch of this type of error 2019-01-28 14:50:01 DEBUG future event, event thread sleeping 34361ms in cond_timedwait Any idea what that means and how to troubleshoot it ?? Many thanks Steven

Hello,   I have 2 infrastructures installed one on Amazon and another on premises. On Amazon every thing is OK, but when I send logs on premises I have a 5 to 7 minutes delayed and I loss almost 30% of the data, I activated the buffer option and I pass through it before sending logs to my on premise server but it doesn't work Somebody know how to correct that?   Thank you for your help and answer   Ana