I am planning to use HEC on heavy forwarder(s) which will forward to the indexer(s).
My question: Is HEC designed to return any error(s) to the sender if it can't keep up with volume of input? Does in-memory input queue configuration have any impact on response?
Yes - if we fail to enqueue events into the queues (in memory or persistent) we will give you back an error (and a 502 response code) to say the service is too busy to handle requests.
Yes - if we fail to enqueue events into the queues (in memory or persistent) we will give you back an error (and a 502 response code) to say the service is too busy to handle requests.
@ineeman
How should we make sure that we don't hit this issue? I keep getting this 503 Server busy error when I have seen a large volume of events getting posted to HEC.
Thanks much!