Distributed log collectors, often deployed as agents on individual nodes, offer significant advantages in modern, distributed environments. A primary benefit is improved performance and reduced resource consumption. By processing, filtering, and batching logs at the source, these agents reduce the volume of data sent over the network and lessen the processing load on the central aggregation system. Another key benefit is reliability; these agents can buffer logs locally if the network connection to the central collector is lost. Once connectivity is restored, the buffered data is resent, preventing log loss during network partitions or aggregator downtime.

A. Support for multiple transport protocols is a feature of the specific logging software, not an inherent benefit of the distributed architectural model itself.

C. A wide range of plugins and accepted formats is a characteristic of a flexible log collector tool, which could be deployed in either a centralized or distributed manner.

D. Extending logs with new fields (enrichment) is a data processing feature available in many log collectors, irrespective of their deployment architecture (distributed vs. centralized).

1. Elasticsearch B.V.

"Filebeat overview". Elastic Guide. The official documentation for Filebeat (a distributed log collector) states

"Filebeat is a lightweight shipper for forwarding and centralizing log data... Because of its lightweight implementation

Filebeat has a low memory footprint and uses a small amount of CPU." It also handles backpressure

stating

"If the Logstash node is busy

Filebeat slows down its read rate. Once the congestion is cleared

Filebeat will resume its original pace and continue shipping data." This supports the benefits of performance/low resource use (B) and buffering/resilience (E).

Reference Location: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html

"How Filebeat works" section.

2. Fluentd Authors

"Architecture". Fluentd Documentation. The official Fluentd documentation describes its architecture

which can be used in a distributed model. It highlights

"Fluentd has a small memory footprint... but it can be extended with plugins." More importantly

it details its reliability mechanisms: "Fluentd supports memory-based and file-based buffering to prevent inter-node data loss. Fluentd also supports robust failover." This local buffering is a core component of distributed collectors and directly supports option E. The lightweight nature supports option B.

Reference Location: https://docs.fluentd.org/architecture

"Architecture" and "Reliability" sections.

3. Sharma

P.

& Gorkhali

A. (2019). "A Microservice Based Scalable

Extensible

and Portable Architecture for Log Analytics". 2019 IEEE International Conference on Big Data (Big Data). This peer-reviewed paper discusses logging architectures for microservices

stating

"The log shipper is a lightweight agent installed on every source... It is responsible for reading log data... and shipping it to the log indexer. It also handles network issues." This academic source confirms that a key role of the distributed agent (shipper) is to handle network issues (E) and be lightweight to reduce resource consumption (B).

DOI: 10.1109/BigData47090.2019.9006038

Section III-A

"Log Shipper".