Buffer overflow from memory to disk is not working

[NikitaDevOps1]

A note for the community

I am using the following configuration as shown in the documentation:

sinks:
  es_cluster_datastream:
    ...
    type: "elasticsearch"
    mode: "data_stream"
    endpoints:
      - "https://127.0.0.1:9200"
    auth:
      strategy: "basic"
      user: "user"
      password: "password"
    data_stream:
      ...
    buffer:
      - type: memory
        max_events: 100
        when_full: overflow
      - type: disk
        max_size: 1073741824
        when_full: block

However, when the memory buffer becomes full, it does not start writing to the disk buffer. Instead, it just keeps events in memory and applies backpressure; the buffer size does not change.

Version: vector 0.48.0 (x86_64-unknown-linux-gnu a67e4e2)

Am I using this configuration correctly, and why might it not be working? When Elasticsearch becomes available again, the memory buffer is freed up and logs are ingested into Vector.

If I use only the disk buffer:

- type: disk
  max_size: 1073741824
  when_full: block

...it works as stated in the documentation, and I can see the buffer size changing.

Why does the configuration with overflow not work?

Problem

Current Behavior:
When the memory buffer reaches its limit (max_events: 100), Vector does not overflow events to the configured disk buffer. Instead, it retains events in memory and applies backpressure. The disk buffer remains unused, and its size does not change.

Expected Behavior:
When the memory buffer is full (when_full: overflow), events should automatically spill over to the disk buffer. The system should utilize the disk tier to absorb the overflow, preventing backpressure until the total buffer capacity (memory + disk) is exhausted. #24304

Configuration

sinks:
  es_cluster_datastream:
    ...
    type: "elasticsearch"
    mode: "data_stream"
    endpoints:
      - "https://127.0.0.1:9200"
    auth:
      strategy: "basic"
      user: "user"
      password: "password"
    data_stream:
      ...
    buffer:
      - type: memory
        max_events: 100
        when_full: overflow
      - type: disk
        max_size: 1073741824
        when_full: block

Version

vector 0.48.0 (x86_64-unknown-linux-gnu a67e4e2)

Debug Output

Example Data

fake logs:
{"host":"78.195.78.234","user-identifier":"AnthraX","datetime":"26/Nov/2025:10:30:51","method":"OPTION","request":"/user/booperbot124","protocol":"HTTP/1.1","status":"301","bytes":40684,"referer":"https://up.xn--3bst00m/controller/setup"}

Additional Context

No response

References

No response