# Could not pack/validate JSON response **URL:** \ **Category:** Elastic Search\ **Tags:** elastic-app-search\ **Created:** [April 8, 2024, 5:52am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938 "2024-04-08T05:52:22Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![rock1013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rock1013/32/133326_2.png) [@rock1013](https://discuss.elastic.co/u/rock1013)\ **Post date:** [April 8, 2024, 5:52am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/1 "2024-04-08T05:52:22Z")
### Elasticsearch Version Version: 8.13.1, Build: deb/9287f29bba5e270bd51d557b8daccb7d118ba247/2024-03-29T10:05:29.787251984Z, JVM: 22 ### Installed Plugins none ### Java Version _bundled_ ### OS Version Linux server102 5.15.0-101-generic [#111](https://github.com/elastic/elasticsearch/issues/111)-Ubuntu SMP Tue Mar 5 20:16:58 UTC 2024 x86\_64 x86\_64 x86\_64 GNU/Linux ### Problem Description After update to 8.12.2 and 8.13.1,ES response of fluentbit cant over 64KB. Json will be truncated. So it cant be parsed. ### Steps to Reproduce With update to 8.12.2 and 8.13.1, the fluentbit logs errors. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 8, 2024, 6:13am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/2 "2024-04-08T06:13:59Z")
Sounds like this is a limitation/problem with fluentbit, which is not supported here. As a potential workaround, have you tried reducing the bulk request size to see if that limits the size of the response? ---
**Author:** ![rock1013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rock1013/32/133326_2.png) [@rock1013](https://discuss.elastic.co/u/rock1013)\ **Post date:** [April 8, 2024, 6:24am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/3 "2024-04-08T06:24:51Z")
Hi Christian\_Dahlqvist, Thanks for help. I checked fluentbit doc, there's no chuck size configure at all. And its set to around 2MB. What we found now is respose tcp window full. I will upload picture. But without upgrade to 8.12.2 from 8.12.1 all things go well. ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/9/0976e940247bdb6d86c26e4c7ad27d80e593defa.png) 200 is es. 240 is fluentbit. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 8, 2024, 6:27am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/4 "2024-04-08T06:27:40Z")
Then it may be an OS level issue. I still do not see how it is an Elasticsearch issue. ---
**Author:** ![rock1013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rock1013/32/133326_2.png) [@rock1013](https://discuss.elastic.co/u/rock1013)\ **Post date:** [April 8, 2024, 6:31am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/5 "2024-04-08T06:31:06Z")
More work we’ve done here is ... 1.the reponse json is cut off ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/eaf85c2aafd5c4d55dc7c390a9d154a3d3d483c2.png) ---
**Author:** ![rock1013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rock1013/32/133326_2.png) [@rock1013](https://discuss.elastic.co/u/rock1013)\ **Post date:** [April 8, 2024, 6:31am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/6 "2024-04-08T06:31:45Z")
Due to new user limit 2.TCP Window Full found ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8bf906c029d52763b1ab4ec37bd3b6431da0e267.png) ---
**Author:** ![rock1013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rock1013/32/133326_2.png) [@rock1013](https://discuss.elastic.co/u/rock1013)\ **Post date:** [April 8, 2024, 6:45am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/7 "2024-04-08T06:45:00Z")
it looks the upgrade made this happen. ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/68586207cf51c7192a2abe0941c49dc991cd7ba6.png) ---
**Author:** ![rock1013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rock1013/32/133326_2.png) [@rock1013](https://discuss.elastic.co/u/rock1013)\ **Post date:** [April 8, 2024, 6:45am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/8 "2024-04-08T06:45:33Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/6/0/60ec79982e67552be676e085a45df9c6a05436ab.png) ---
**Author:** ![rock1013](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rock1013/32/133326_2.png) [@rock1013](https://discuss.elastic.co/u/rock1013)\ **Post date:** [April 8, 2024, 11:01am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/9 "2024-04-08T11:01:59Z")
My apology, I bypassed the openresty nginx. Things go well again. ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [April 10, 2024, 9:18am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/10 "2024-04-10T09:18:20Z")
As mentioned [here](https://github.com/elastic/elasticsearch/issues/107186#issuecomment-2046972203), this is happening because you're disabling support for chunked encoding. Don't do that, chunked encoding is a mandatory part of HTTP/1.1. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 8, 2024, 9:18am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/356938/11 "2024-05-08T09:18:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.