APM through logstash TCP, Message too big

Elastic Observability APM
1

My usecase APM-Agent -> APM-Server -> Logstash -> Logstash -> ES .

My Problem: Logstash -> Logstash is via TCP json_lines. Some APM-Messages getting json parsing errors without further explanaiton. Is it possible that my problem is the json_lines codec?

Logstash errors:

[2019-04-08T10:37:32,148][WARN ][logstash.codecs.jsonlines] lFilterChain\",\"function\": ...

I cant switch to anything else then tcp, and because tcp automaticaly switches to json_lines. Is there a known workaround for this?

When I change my delimiter to "\0", i get the same errors.

EDIT 2: It seems like its happening when i get Errors with stack traces. -> EDIT 3: its not only with stack traces!
EDIT 3: With udp as transport protocol its working as expected. No jsonparse errors. But I cant use UDP, i have to use TCP!

thanks

2

Is it possible that because the problematic message is 31789 bytes long that the tcp buffer implementation in logstash cant handle this?

ref: https://github.com/logstash-plugins/logstash-input-tcp/issues/51#issuecomment-309729030

4

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.