# Bulk Size error on filebeat

**URL:** <https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 28, 2017, 6:39pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373 "2017-05-28T18:39:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [May 28, 2017, 6:39pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373/1 "2017-05-28T18:39:21Z")

</div>

Hi there  
I'm seeing this on filebeat log file that I found just by accident while debuggin an issue.

`2017-05-28T18:35:26Z INFO Error publishing events (retrying): 413 Request Entity Too Large`

In the configuration file there is a line that says no to modify:

```
# The internal queue size for bulk events in the processing pipeline.
# Do not modify this value.
#bulk_queue_size: 0

```

How can I get rid or those errors? and I guess that I'm loosing data because if this, so how can I fix this?

filebeat-5.4.0-1.x86\_64

Thanks in adavance  
Regards

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [May 29, 2017, 3:17am UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373/2 "2017-05-29T03:17:02Z")

</div>

Hello,

I presume you are using Elasticsearch output. This error means that filebeat is sending a bulk request with a body that is too big for Elasticsearch to handle (i.e. you have long log messages). You could try setting a lower `bulk_max_size` in the output configuration (default is `50`)

Cheers

---

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [May 29, 2017, 1:37pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373/3 "2017-05-29T13:37:46Z")

</div>

Hi thiago, yes, the output is ES, I'll try to change that value to 100 maybe?, my concern was about the comment  
that says NOT to change that value , and do not know why.

Thanks  
Regards

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [May 29, 2017, 1:46pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373/4 "2017-05-29T13:46:38Z")

</div>

The setting that I am referring to is `bulk_max_size` which is different from `bulk_queue_size` (which has the warning). Also you should _lower_ it and not increase, because the issue is related to how much data filebeat is trying to push into ES.

---

<div class="post-metadata">

**Author:** ![Kernel\_Panic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kernel_panic/32/12294_2.png) [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\
**Post date:** [May 29, 2017, 1:47pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373/5 "2017-05-29T13:47:33Z")

</div>

Ok, thank you buddy.!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2017, 1:48pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373/6 "2017-06-26T13:48:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.