Forwarders automatically queue data when they can't reach an indexer. Usually, that queue is enough to hold events until an indexer is available, but it may not be enough if all are indexers are down for a prolonged period or if a lot of events are generated during the outage.
The maxQueueSize setting in outputs.conf may help. Increasing the value from the default of 500KB should help.
If you have enough resources, consider standing up a second indexer so you're more likely to have one available at all times. It'll help with search performance, too.
... View more