How can I prevent my syslog-ng server from 'pinning' to a single stream worker process when sending syslog over TCP? Am sending too much data for that single WP to handle?

When using syslog-ng server my syslog data is ‘pinning’ to a single stream worker process when sending syslog over TCP. Am sending too much data for that single WP to handle?

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.33/administration-guide/34

With syslog-ng you can use the elastic output module to set all of your workers as destinations. You would then build a source in stream of “Elastic-API”. Depending on your environment you will want to tweak the following:

batch-lines(100)
batch-bytes(512Kb)
batch-timeout(10000)

1 UpGoat