From 5c3a69d74239ab4246a26be9a56f4a0c7b4493bf Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Thu, 20 Aug 2026 17:33:34 -0400 Subject: [PATCH] Warn about two pipeline_settings combinations that stop a pipeline Grid testing every permitted value on the manager pipeline surfaced two combinations the UI allows that take the pipeline down, neither of which the descriptions mentioned. pipeline.ordered: true requires pipeline.workers: 1; with more workers the pipeline fails to start with "enabling the 'pipeline.ordered' setting requires the use of a single pipeline worker". Also correct the auto wording: it only engages when workers is explicitly set to 1. queue.max_bytes larger than the free space on /nsm/logstash fails queue creation with "Unable to allocate N more bytes", rather than merely being inadvisable. --- salt/logstash/soc_logstash.yaml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/salt/logstash/soc_logstash.yaml b/salt/logstash/soc_logstash.yaml index bce0e97c7..729b8c242 100644 --- a/salt/logstash/soc_logstash.yaml +++ b/salt/logstash/soc_logstash.yaml @@ -103,8 +103,10 @@ logstash: helpLink: logstash pipeline_x_ordered: description: >- - Whether event order is preserved through this pipeline. auto enables ordering only when the - pipeline runs a single worker. Leave blank to use the value from logstash.yml. + Whether event order is preserved through this pipeline. auto enables ordering only when + pipeline.workers is explicitly set to 1, and does nothing otherwise. Setting this to true + requires pipeline.workers to be 1 as well; with more workers this pipeline fails to start. + Leave blank to use the value from logstash.yml. title: pipeline.ordered options: - '' @@ -157,8 +159,9 @@ logstash: queue_x_max_bytes: description: >- Total capacity of the persistent queue for this pipeline, in bytes. Only applies when - queue.type is persisted. The disk backing /nsm/logstash must be larger than this value. If - both queue.max_events and queue.max_bytes are set, whichever is reached first applies. Leave + queue.type is persisted. The disk backing /nsm/logstash must have room for this much data or + the pipeline fails to start, reporting that it was unable to allocate the space. If both + queue.max_events and queue.max_bytes are set, whichever is reached first applies. Leave blank to use the value from logstash.yml. title: queue.max_bytes regex: '^$|^[0-9]+$|^[0-9]+(\.[0-9]+)?\s*(b|kb?|mb?|gb?|tb?|pb?)$'