Event.get(message).bytesize

[jchaves506]

Continuing the discussion from How to get entire enriched "event" size (not message size):

I'm using metricbeat, and I'm looking to know what's the size of the message, I tried using that but I'm getting:

[ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined method `bytesize' for nil:NilClass

I've been looking for a reference page about what other options do I have to get this but I couldn't find it. I also found someone saying about mentioning the LENGTH attribute could be used but that didn't work either.

could someone please help me on this?

thanks

[Badger]

It is really not a simple question to answer, because it is unclear what you are asking for. If you want the length of the JSON string that will get written to elasticsearch then serialize the event and check the length of the string.

If you want an approximation of the size of the entire event then you could re-purpose some code.

If you want to know how much memory is allocated for an object that will vary between JVMs, and depend on what other objects exist (think string pools).

Note that

ruby { code => 'event.set("size", event.to_s.bytesize)' }

does not do what you want because event.to_s does not do what you expect.

[jchaves506]

Thanks... well, what I'm looking is a way to know the size of the message logstash is analizing, the code below works for events from winlogbeats, but not for metricbeats, I guess the attribute 'message' is not part of the event for metricbeat, and wondering what would it be then, I haven't found any documentation about that.
Probably packetbeat could tell me easier what's the size of the package sent by the device but is not my intention to use that.

    filter {
        ruby {
            code => "event.set('message_size', event.get('message').bytesize)"
        }
    }

[jchaves506]

Ok... since the only module I have active in metricbeat is SYSTEM.YML what I did was:

ruby { 
         code => "event.set('systemSize', event.get('system').to_s.bytesize)"
}

that is returning what I suppose is the size of that message from beats, at list the part related to the module at least.