APM Server reported 400: decode error: data read error

Kibana version: v8.13.3

Elasticsearch version: v8.13.3

APM Server version: v8.13.3

APM Agent language and version: elastic-apm-agent-1.52.1.jar

Original install method (e.g. download page, yum, deb, from source, etc.) and version: -javaagent

Fresh install or upgraded from other version? Fresh install

Is there anything special in your setup? using Kafka output
apm.properties:

recording=true
service_name=xxxxxx
environment=prod
server_urls=http://xxxx:8200,http://xxxxx:8200,http://xxxxx:8200,http://xxxxx:8200,http://xxxxx:8200
service_node_name=xxxxxxx
log_level=INFO
log_file=/opt/apm/apm-agent.log
log_ecs_reformatting=SHADE
log_ecs_reformatting_dir=/opt/apm
capture_body=off
transaction_max_spans=500
transaction_sample_rate=0.3
circuit_breaker_enabled=true

apm server config:

apm-server:
  host: "xxxxxxxxxxxxxxxxxxxxx"
  max_event_size: 807200
  data_streams.namespace: xxxxxxxxxxxxx
  data_streams.wait_for_integration: false
  agent.config:
    cache.expiration: 30s
    elasticsearch:
      hosts: [xxxxxxxxxxxxxxxxxxxxxxxxx]
      username: "xxxxxxxxxxxxxxxx"
      password: "xxxxxxxxxxxxx"
output.kafka:
  enabled: true
  hosts: [xxxxxxxxxxxxxxxxxx]
  topic: "apm-%{[data_stream.type]}"
  partition.round_robin:
    reachable_only: false
  worker: 30
  bulk_max_size: 102400
  channel_buffer_size: 2048
logging.level: info
logging.metrics.enabled: true
logging.metrics.period: 30s
logging.to_files: true
logging.files:
  path: /var/log/apm-server/yinhai
  name: apm-server
  keepfiles: 7
monitoring.enabled: true
monitoring.elasticsearch:
  cluster_uuid: xxxxxxxxxxxxxxxxxxx
  username: "xxxxxxxxxxxxxxxxxx"
  password: "xxxxxxxxxxxxxxxx"
  hosts: [xxxxxxxxxxxxxxxxxxxxx]

error log:

2025-03-12 11:08:01,993 [elastic-apm-server-reporter] WARN  co.elastic.apm.agent.report.AbstractIntakeApiHandler - Response body: {
  "accepted": 30,
  "errors": [
    {
      "message": "cannot handle stream: cannot process batch: queue is full"
    }
  ]
}

2025-03-12 11:08:01,994 [elastic-apm-server-reporter] INFO  co.elastic.apm.agent.report.AbstractIntakeApiHandler - Backing off for 0 seconds (+/-10%)
2025-03-12 11:08:01,994 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.AbstractIntakeApiHandler - Error sending data to APM server: Server returned HTTP response code: 503 for URL: http://10.109.97.34:8200/intake/v2/events, response code is 503
2025-03-12 15:36:43,016 [http-nio-8080-exec-5] WARN  co.elastic.apm.agent.impl.transaction.SpanImpl - Max spans (500) for transaction 'TarunqianresourcePrintRestController#printAsPdfByUrl' 00-9c16b9b3579c0a06fd9caee57aa39768-cead3d4e7f073b0e-01 (1dad4bf) has been reached. For this transaction and possibly others, further spans will be dropped. See config param 'transaction_max_spans'.
2025-03-12 15:48:59,491 [http-nio-8080-exec-13] WARN  co.elastic.apm.agent.impl.transaction.SpanImpl - Max spans (500) for transaction 'CommonQueryController#getPsnByConditionAllot' 00-ba78a1f0eec8ea4b490de66de0d7ac93-6b10cea1a2198fbc-00 (75282f4a) has been reached. For this transaction and possibly others, further spans will be dropped. See config param 'transaction_max_spans'.
2025-03-12 17:11:54,769 [http-nio-8080-exec-3] WARN  co.elastic.apm.agent.impl.transaction.SpanImpl - Max spans (500) for transaction 'PublicStaffInsuRegServiceImpl#saveStaffInsuRegJingBan' 00-ccad12bd37b0930511824b174e74a915-7d16523dbaddace3-01 (7f5352a4) has been reached. For this transaction and possibly others, further spans will be dropped. See config param 'transaction_max_spans'.
2025-03-12 17:11:58,793 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Failed to handle event of type TRANSACTION with this error: null
2025-03-12 17:11:58,840 [elastic-apm-server-reporter] WARN  co.elastic.apm.agent.report.AbstractIntakeApiHandler - Response body: {
  "accepted": 10,
  "errors": [
    {
      "message": "decode error: data read error: v2.transactionRoot.Transaction: v2.transaction.DroppedSpanStats: []v2.transactionDroppedSpanStats: v2.transactionDroppedSpanStats.readFieldHash: expect \",",
      "document": "{\"transaction\":{\"timestamp\":1741770713031000,\"name\":\"PublicStaffInsuRegServiceImpl#saveStaffInsuRegJingBan\",\"id\":\"7d16523dbaddace3\",\"trace_id\":\"ccad12bd37b0930511824b174e74a915\",\"type\":\"request\",\"duration\":5759.455,\"result\":\"HTTP 2xx\",\"outcome\":\"success\",\"context\":{\"service\":{\"framework\":{\"version\":\"5.0.13.RELEASE\",\"name\":\"Spring Web MVC\"},\"version\":null},\"request\":{\"method\":\"POST\",\"headers\":{\"x-tif-paasid\":\"mbs_gg_dev\",\"x-tif-signature\":\"8C7DDD414EAEB274663571C69EEEA30B5DC9FF1A57E7909EA15A603979778C19\",\"x-tif-timestamp\":\"1741770713\",\"x-tif-nonce\":\"iyuk20EWQbEkT7QCbdmOhyXjMTnNfEIQ\",\"eagleeye-userdata\":\"userData=rO0ABXNyACtjbi5oc2EuaHNhZi5jb3JlLmZyYW1ld29yay51dGlsLkN1cnJlbnRVc2VyAAAAAAAAAAECAA1MABNJbnN1VHlwZVBvb2xBcmVhTWFwdAAPTGphdmEvdXRpbC9NYXA7TAAGYWRtRHZzdAASTGphdmEvbGFuZy9TdHJpbmc7TAAGZGVwdElEcQB+AAJMAAhkZXB0TmFtZXEAfgACTAAEbmFtZXEAfgACTAAHb3JnQ29kZ3EAfgACTAAHb3JnTmFtZXEAfgACTAAIb3JnVW50SURxAH4AAkwADHBvb2xBcmVhQ29kZ3EAfgACTAAJcHJudE9yZ0lEcQB+AAJMAAZ1YWN0SURxAH4AAkwACHVzZXJBY2N0cQB+AAJMAAp1c2VyQWNjdElEcQB+AAJ4cHNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAB3CAAAABAAAAAAeHBwcHBwcHBwcHBwcA==\u0026aid=1741770716009\",\"content-length\":\"3336\",\"content-type\":\"text/plain; charset=UTF-8\",\"user-agent\":\"Apache-HttpClient/4.5.9 (Java/1.8.0_252)\",\"x-forwarded-for\":\"xx.xx.xx.xx,xx.xx.xx.xx,127.0.0.1\",\"x-real-ip\":\"xx.xx.xx.xx\",\"x-proxy-by\":\"Tif-APIGate\",\"x-forwarded-proto\":\"http\",\"x-rio-nonce\":\"iyuk20EWQbEkT7QCbdmOhyXjMTnNfEIQ\",\"x-rio-paasid\":\"mbs_gg_dev\",\"host\":\"xx.xx.xx.xx:8080\",\"x-rio-timestamp\":\"1741770713\",\"x-rio-signature\":\"8C7DDD414EAEB274663571C69EEEA30B5DC9FF1A57E7909EA15A603979778C19\",\"connection\":\"keep-alive\",\"accept-encoding\":\"gzip\"},\"cookies\":{\"BIGipServerrs_yinhai_arc_8080\":\"1966319808.36895.0000\",\"BIGipServerrs_yinhai_bic_8080\":\"4281903296.36895.0000\",\"BIGipServerrs_yinhai_mbs-pub-svc_8080\":\"3157829824.36895.0000\",\"BIGipServerrs_yinhai_pic_8080\":\"3090655424.36895.0000\",\"BIGipServerrs_yinhai_usc_8080\":\"121219264.36895.0000\",\"XSRF-TOKEN\":\"[REDACTED]\",\"x_host_key\":\"[REDACTED]\"},\"body\":\"[REDACTED]\",\"url\":{\"full\":\"http://xx.xx.xx.xx:8080/mbs/api/publicStaffInsuReg/saveStaffInsuRegJingBan?\",\"hostname\":\"xx.xx.xx.xx\",\"port\":8080,\"pathname\":\"/mbs/api/publicStaffInsuReg/saveStaffInsuRegJingBan\",\"search\":\"\",\"protocol\":\"http\"},\"socket\":{\"remote_address\":\"xx.xx.xx.xx\"},\"http_version\":\"1.1\"},\"response\":{\"headers\":{\"Cache-Control\":\"no-store\",\"X-Content-Type-Options\":\"nosniff\",\"X-XSS-Protection\":\"1; mode=block\",\"Content-Type\":\"application/json;charset=UTF-8\",\"Content-Language\":\"en-US\",\"Transfer-Encoding\":\"chunked\",\"Date\":\"Wed, 12 Mar 2025 09:11:57 GMT\"},\"finished\":true,\"headers_sent\":true,\"status_code\":200},\"tags\":{}},\"span_count\":{\"dropped\":521,\"started\":500},\"dropped_spans_stats\":[{\"destination_service_resource\":\"xx.xx.xx.xx:8080\",\"service_target_type\":\"http\",\"service_target_name\":\"192.168.55.176:8080\",\"outcome\":\"success\",\"duration\":{\"count\":2,\"sum\":{\"us\":11752}}},{\"destination_service_resource\":\"\","
    }
  ]
}

2025-03-12 17:11:58,841 [elastic-apm-server-reporter] INFO  co.elastic.apm.agent.report.AbstractIntakeApiHandler - Backing off for 0 seconds (+/-10%)
2025-03-12 17:11:58,841 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.AbstractIntakeApiHandler - Error sending data to APM server: Server returned HTTP response code: 400 for URL: http://xx.xx.xx.xx:8200/intake/v2/events, response code is 400
{"log.level":"error","@timestamp":"2025-03-12T17:11:58.839+0800","log.logger":"request","log.origin":{"function":"github.com/elastic/apm-server/internal/beater/api.apmMiddleware.LogMiddleware.func1.1","file.name":"middleware/log_middleware.go","file.line":59},"message":"data validation error","service.name":"apm-server","url.original":"/intake/v2/events","http.request.method":"POST","user_agent.original":"apm-agent-java/1.52.1 (xx.xx.xx.xx 2.0.0-SNAPSHOT)","source.address":"xx.xx.xx.xx","http.request.id":"620dfbf5-d565-4def-bb3b-d4b787eaf99b","event.duration":941481635,"http.request.body.bytes":5194,"http.response.status_code":400,"error.message":"decode error: data read error: v2.transactionRoot.Transaction: v2.transaction.DroppedSpanStats: []v2.transactionDroppedSpanStats: v2.transactionDroppedSpanStats.readFieldHash: expect \",","ecs.version":"1.6.0"}

Did you check the APM-server logs? It looks like your APM-server (or the kafka infrastructure is overloaded).

This is indicated by the first error:

"message": "cannot handle stream: cannot process batch: queue is full"

The second error looks like the payload sent from the agent was cut off at the end and therefore is not decodeable, which also is likely due to the apm-server overload.

hello @arT1

I can confirm what Jonas already reported.

The events are processed by the Publisher and there are runtime.GOMAXPROCS(0) instances of Publisher that are actively sending in the output via libbeat (in this case Kafka output).

See apm-server/internal/publish/pub.go at 4f41c40c1570512138cd73d2f30e2b5d8d5ffa53 · elastic/apm-server · GitHub

If your APM Server is running on a VM with limited CPUs, or it's configured as a Kubernetes Pod with constrained CPU shares, you may have to increase the number of cores available to it to allow it to fulfill the traffic you are shipping to it.

hi @Francesco_Gualazzi @Jonas_Kunz
Yes, I have checked the APM-server logs and found more error messages.

"message":"request timed out"

I have also examined the resource usage of the Kafka infrastructure during peak hours, and everything was normal.

So I believed that it was most likely due to the APM-server being overloaded, I attempted to reduce the sampling rate and horizontally scale the APM-server to five instances.

server_urls=http://xxxx:8200,http://xxxxx:8200,http://xxxxx:8200,http://xxxxx:8200,http://xxxxx:8200
transaction_sample_rate=0.3

I did not configure max_procs, and all APM-servers are running on physical machines with 112 logical cores, with sufficient physical resources.

CPU


Memory

I also tried to modify the bulk_max_size and worker of the Kafka output, but the APM-server still have error message.

output.kafka:
  enabled: true
  hosts: [xxxxxxxxxxxxxxxxxx]
  topic: "apm-%{[data_stream.type]}"
  partition.round_robin:
    reachable_only: false
  worker: 30
  bulk_max_size: 102400
  channel_buffer_size: 2048

google found queue.* needed to be configured, but a query of the documentation found that queue was removed after 8.0.* In the APM-server configuration

I see 3 different error messages right now reported in this thread

  • 400: decode data: read error
  • cannot handle stream: cannot process batch: queue is full
  • "message":"request timed out"

I am not sure which one we're debugging though.
The 400 HTTP code error is telling us the input data are likely formatted in a wrong way, and it's a legit error.
I would suggest to get rid of those in first instance.

Secondarily, you seem to have a capacity issue, although the machine hosting APM Server has 112 cores.
The "queue is full" message indicates workers are stuck for more than 1 second processing the send to publisher; consequently, Kafka is under-utilized as the processing is stuck in APM Server, and requests are timing out.

Some more questions on this:

  • is APM Server the only process running on that machine? if yes, what is the reason to set worker to 30?
  • what APM Server and OS metrics are you monitoring to understand if the process is actually using all the available cores? from the picture you posted, it looks like it's only using 10-11.can you check how many goroutines and threads are used by the Go runtime running APM Server?
  • how many events per second are you trying to ingest?

is APM Server the only process running on that machine? if yes, what is the reason to set worker to 30?

Elasticsearch is also running on the machine hosting the APM-Server. The worker is set to 30 because we are increasing kafka output.

what APM Server and OS metrics are you monitoring to understand if the process is actually using all the available cores? from the picture you posted, it looks like it's only using 10-11.can you check how many goroutines and threads are used by the Go runtime running APM Server?

I don't know how to check how many goroutines are used by the Go runtime running APM Server, I don't know Go language.
The APM Server runtime used 119 threads.
image

how many events per second are you trying to ingest?

The peak is about 60,000 events per second

Thanks for reporting this :folded_hands:

Are you running Elasticsearch with some limitations/configurations to its CPU and memory usage?

I would advise these 2 items as next steps:

  1. enable APM Server instrumentation, so you can collect APM Server metrics, including Go runtime metrics, in Elasticsearch; then you can build accurate monitoring for it.
  2. reduce the number of available threads for APM Server, by setting the environment variable GOMAXPROCS in the APM server environment, probably you can start with 32, since you set worker to 30, you could increase it but it depends how much Elasticsearch is hitting on CPU

When you say 60k events/sec, these are not requests per second correct?
We are talking about 60k instances of traces/metrics/logs event ingested in each second?
Can you please clarify this? If that's the case, the APM workload is not big.
But if Elasticsearch is also used for other ingestion, that might explain the slowness, probably the JVM is taking away all the CPU time.

Thanks for your advice.

Are you running Elasticsearch with some limitations/configurations to its CPU and memory usage?

The Elasticsearch package is configured to run as a service under systemd, with the JVM heap size settings adjusted to -Xms31g and -Xmx31g.

enable APM Server instrumentation, so you can collect APM Server metrics, including Go runtime metrics, in Elasticsearch; then you can build accurate monitoring for it.

I will enable APM Server instrumentation and restart APM Server during low peak periods

reduce the number of available threads for APM Server, by setting the environment variable GOMAXPROCS in the APM server environment, probably you can start with 32, since you set worker to 30, you could increase it but it depends how much Elasticsearch is hitting on CPU

Sorry, I don't know much about how to set the environment variable GOMAXPROCS in APM server environment. Is there any relevant documentation?
Yes,We are talking about 60k instances of traces/metrics/logs event ingested in each second.

But if Elasticsearch is also used for other ingestion, that might explain the slowness, probably the JVM is taking away all the CPU time.

I quite agree with you. At peak times the JVM takes up a lot of CPU resources, but if so, I need more machine resources to deploy the APM Server, but my resources are limited
Elasticsearch node CPU mon

Hello @arT1, if you still need help with your issue. In order to move forward from here, we will need to see some telemetry. To get it you should follow the advice from @Francesco_Gualazzi provided in APM Server reported 400: decode error: data read error - #7 by Francesco_Gualazzi to enable internal monitoring.

One quick option to go about this is to set http.enabled: true in apm-server.yaml config file (see full guide on metricbeat metrics collection for your reference). With this option enabled you could then use local http://localhost:5066/stats endpoint to capture some useful beats stats.

Look for libbeat.type: "kafka" stats as they should help you to understand your issue better.

 "libbeat": {
    "output": {
      "batches": {
        "split": 0
      },
      "events": {
        "acked": 0,
        "active": 0,
        "batches": 0,
        "dead_letter": 0,
        "dropped": 0,
        "duplicates": 0,
        "failed": 0,
        "toomany": 0,
        "total": 0
      },
      "read": {
        "bytes": 0,
        "errors": 0
      },
      "type": "kafka",
      "write": {
        "bytes": 0,
        "errors": 0,
        "latency": {
          "histogram": {
            "count": 0,
            "max": 0,
            "mean": 0,
            "median": 0,
            "min": 0,
            "p75": 0,
            "p95": 0,
            "p99": 0,
            "p999": 0,
            "stddev": 0
          }
        }
      }
    }

(post deleted by author)

Hello @Kostya_Masliuk @Francesco_Gualazzi @Jonas_Kunz ,I followed your advice.

  1. The sampling rate was adjusted from 0.3 to 0.1 to reduce the apm data to ease the load on the APM Server
  2. ES data-hot nodes are migrated to other physical machines to avoid CPU contention
  3. set worker to 32 and set GOMAXPROCS to 32
  4. enabled monitor

The number of errors in queue is full decreases, but there are still a small number of errors and errors related to data validation error.

apm-server-20250324.ndjson:{"log.level":"error","@timestamp":"2025-03-25T09:43:33.966+0800","log.logger":"request","log.origin":{"function":"github.com/elastic/apm-server/internal/beater/api.apmMiddleware.LogMiddleware.func1.1","file.name":"middleware/log_middleware.go","file.line":59},"message":"data validation error","service.name":"apm-server","url.original":"/intake/v2/events","http.request.method":"POST","user_agent.original":"apm-agent-java/1.52.1 (xxxxx 2.0.0-SNAPSHOT)","source.address":"10.109.90.93","trace.id":"050cb8e30c38d9dd002d28648ae1e19c","transaction.id":"050cb8e30c38d9dd","http.request.id":"050cb8e30c38d9dd","event.duration":8326198331,"http.request.body.bytes":82409,"http.response.status_code":400,"error.message":"decode error: data read error: v2.transactionRoot.Transaction: v2.transaction.DroppedSpanStats: v2.transactionDroppedSpanStats: v2.transactionDroppedSpanStats.readFieldHash: expect ",","ecs.version":"1.6.0"}

I took your advice and got some surveillance data

  1. APM Server-enabled instruments

    image


  2. use local http://localhost:5066/stats endpoint to capture some useful beats stats.
{
    "apm-server": {
        "acm": {
            "request": {
                "count": 381647
            },
            "response": {
                "count": 381647,
                "errors": {
                    "closed": 0,
                    "count": 1,
                    "decode": 0,
                    "forbidden": 0,
                    "internal": 0,
                    "invalidquery": 0,
                    "method": 0,
                    "notfound": 0,
                    "queue": 0,
                    "ratelimit": 0,
                    "timeout": 0,
                    "toolarge": 0,
                    "unauthorized": 0,
                    "unavailable": 1,
                    "validate": 0
                },
                "valid": {
                    "accepted": 0,
                    "count": 381646,
                    "notmodified": 381644,
                    "ok": 2
                }
            },
            "unset": 0
        },
        "agentcfg": {
            "elasticsearch": {
                "cache.entries.count": 1,
                "cache.refresh.failures": 0,
                "cache.refresh.successes": 1993,
                "fetch.es": 381646,
                "fetch.fallback": 0,
                "fetch.invalid": 0,
                "fetch.unavailable": 1
            }
        },
        "jaeger": {
            "grpc": {
                "collect": {
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0,
                            "ratelimit": 0,
                            "timeout": 0,
                            "unauthorized": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                },
                "sampling": {
                    "event": {
                        "received": {
                            "count": 0
                        }
                    },
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                }
            }
        },
        "otlp": {
            "grpc": {
                "logs": {
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0,
                            "ratelimit": 0,
                            "timeout": 0,
                            "unauthorized": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                },
                "metrics": {
                    "consumer": {
                        "unsupported_dropped": 0
                    },
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0,
                            "ratelimit": 0,
                            "timeout": 0,
                            "unauthorized": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                },
                "traces": {
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0,
                            "ratelimit": 0,
                            "timeout": 0,
                            "unauthorized": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                }
            },
            "http": {
                "logs": {
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0,
                            "ratelimit": 0,
                            "timeout": 0,
                            "unauthorized": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                },
                "metrics": {
                    "consumer": {
                        "unsupported_dropped": 0
                    },
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0,
                            "ratelimit": 0,
                            "timeout": 0,
                            "unauthorized": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                },
                "traces": {
                    "request": {
                        "count": 0
                    },
                    "response": {
                        "count": 0,
                        "errors": {
                            "count": 0,
                            "ratelimit": 0,
                            "timeout": 0,
                            "unauthorized": 0
                        },
                        "valid": {
                            "count": 0
                        }
                    }
                }
            }
        },
        "processor": {
            "error": {
                "transformations": 1885682
            },
            "metric": {
                "transformations": 46109891
            },
            "span": {
                "transformations": 45758256
            },
            "stream": {
                "accepted": 96034906,
                "errors": {
                    "invalid": 16,
                    "toolarge": 0
                }
            },
            "transaction": {
                "transformations": 6846256
            }
        },
        "root": {
            "request": {
                "count": 6
            },
            "response": {
                "count": 6,
                "errors": {
                    "closed": 0,
                    "count": 0,
                    "decode": 0,
                    "forbidden": 0,
                    "internal": 0,
                    "invalidquery": 0,
                    "method": 0,
                    "notfound": 0,
                    "queue": 0,
                    "ratelimit": 0,
                    "timeout": 0,
                    "toolarge": 0,
                    "unauthorized": 0,
                    "unavailable": 0,
                    "validate": 0
                },
                "valid": {
                    "accepted": 0,
                    "count": 6,
                    "notmodified": 0,
                    "ok": 6
                }
            },
            "unset": 0
        },
        "sampling": {
            "transactions_dropped": 0
        },
        "server": {
            "request": {
                "count": 847785
            },
            "response": {
                "count": 847726,
                "errors": {
                    "closed": 0,
                    "count": 17,
                    "decode": 0,
                    "forbidden": 0,
                    "internal": 1,
                    "invalidquery": 0,
                    "method": 0,
                    "notfound": 0,
                    "queue": 0,
                    "ratelimit": 0,
                    "timeout": 0,
                    "toolarge": 0,
                    "unauthorized": 0,
                    "unavailable": 0,
                    "validate": 16
                },
                "valid": {
                    "accepted": 847709,
                    "count": 847709,
                    "notmodified": 0,
                    "ok": 0
                }
            },
            "unset": 0
        }
    },
    "beat": {
        "cpu": {
            "system": {
                "ticks": 1134060,
                "time": {
                    "ms": 1134060
                }
            },
            "total": {
                "ticks": 29444630,
                "time": {
                    "ms": 29444630
                },
                "value": 29444630
            },
            "user": {
                "ticks": 28310570,
                "time": {
                    "ms": 28310570
                }
            }
        },
        "handles": {
            "limit": {
                "hard": 4096,
                "soft": 4096
            },
            "open": 331
        },
        "info": {
            "ephemeral_id": "79e488be-fa67-48b5-9ae8-fdc8a17841e2",
            "name": "apm-server",
            "uptime": {
                "ms": 59773250
            },
            "version": "8.13.3"
        },
        "memstats": {
            "gc_next": 384114440,
            "memory_alloc": 291624632,
            "memory_sys": 891980232,
            "memory_total": 4435513622672,
            "rss": 414969856
        },
        "runtime": {
            "goroutines": 478
        }
    },
    "libbeat": {
        "output": {
            "batches": {
                "split": 0
            },
            "events": {
                "acked": 100598400,
                "active": 1600,
                "batches": 62875,
                "dropped": 0,
                "duplicates": 0,
                "failed": 0,
                "toomany": 0,
                "total": 100600000
            },
            "read": {
                "bytes": 0,
                "errors": 0
            },
            "type": "kafka",
            "write": {
                "bytes": 0,
                "errors": 0,
                "latency": {
                    "histogram": {
                        "count": 0,
                        "max": 0,
                        "mean": 0,
                        "median": 0,
                        "min": 0,
                        "p75": 0,
                        "p95": 0,
                        "p99": 0,
                        "p999": 0,
                        "stddev": 0
                    }
                }
            }
        },
        "outputs": {
            "kafka": {
                "bytes_read": 836912677,
                "bytes_write": 51117845525
            }
        },
        "pipeline": {
            "clients": 1,
            "events": {
                "active": 1685,
                "dropped": 0,
                "failed": 0,
                "filtered": 0,
                "published": 100600085,
                "retry": 1600,
                "total": 100600085
            },
            "queue": {
                "acked": 100598400,
                "max_events": 3200
            }
        }
    },
    "system": {
        "cpu": {
            "cores": 112
        },
        "load": {
            "1": 4.21,
            "5": 4.85,
            "15": 4.94,
            "norm": {
                "1": 0.0376,
                "5": 0.0433,
                "15": 0.0441
            }
        }
    }
}