Update queue / ES connection defaults

[faec]

Apply the remaining config defaults changes in https://github.com/elastic/ingest-dev/issues/2399, following the conclusion of the benchmark tests of the new values under varying input loads. Full discussion of the changes and associated benchmarks are in that issue. All changes are neutral or positive on all tests, both individually and in combination. The bulk_max_size change in particular gives a significant reduction in CPU use, while the timeout changes reduce average connection count for many use cases.

The full changes from this PR are:

Queue:

• queue.mem.events: 4096 -> 3200
• queue.mem.flush.min_events: 2048 -> 1600
• queue.mem.flush.timeout: 1s -> 10s

ES output:

• output.elasticsearch.bulk_max_size: 50 -> 1600
• output.elasticsearch.idle_connection_timeout: 60s -> 3s

These changes will only take effect on configurations where the flags are unspecified. Any explicit user settings of these flags (in Beats or Agent) will override the values here.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Closes https://github.com/elastic/ingest-dev/issues/2399

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @faec? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-10-31T12:51:48.738+0000

• Duration: 133 min 53 sec

Test stats 🧪

Test	Results
Failed	0
Passed	28622
Skipped	2015
Total	30637

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[StephanErb]

Does that imply it is generally recommended to set queue.mem.flush.min_events == output.elasticsearch.bulk_max_size even for other bulk sizes?

[strawgate]

Does that imply it is generally recommended to set queue.mem.flush.min_events == output.elasticsearch.bulk_max_size even for other bulk sizes?

Short answer is yes.
Long answer is that there are two constraints on min_events:

1. min_events controls the size of the batch that gets dispatched to the output under load and so max_bulk_size can never actually be larger than min_flush and
2. for best performance min_flush should be a multiple of max_bulk_size to ensure that the when the flush occurs it creates full batches for the output. In this case we're sticking with a multiple of 1 between max_bulk_size and min_flush