# Filebeat cant send large log data to es

**URL:** <https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 31, 2018, 9:24am UTC](https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012 "2018-05-31T09:24:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![XIAOXIELM](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xiaoxielm/32/31773_2.png) [@XIAOXIELM](https://discuss.elastic.co/u/XIAOXIELM)\
**Post date:** [May 31, 2018, 9:24am UTC](https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012/1 "2018-05-31T09:24:12Z")

</div>

Now at product env. When I restart es（filebeat is still running）, I will meet an issue that filebeat doesn't send the log info to es. one line log is too large（7K） may cause this issue?

the filebeat.yml

- type: log  
ignore\_older: 48h  
close\_inactive: 2h  
close\_timeout: 10m  
clean\_inactive: 72h

- output.elasticsearch:  
max\_retries: 2  
timeout: 300

Version: filebeat 6.2.3  
Operating System: CentOS release 6.8

---

<div class="post-metadata">

**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\
**Post date:** [May 31, 2018, 10:07am UTC](https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012/2 "2018-05-31T10:07:57Z")

</div>

7KB?

What do you see in the logs or std out to denote filebeat is unable to send to ES?  
Has the output to elasticsearch such as host and port been uncommented and set correctly?

---

<div class="post-metadata">

**Author:** ![XIAOXIELM](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xiaoxielm/32/31773_2.png) [@XIAOXIELM](https://discuss.elastic.co/u/XIAOXIELM)\
**Post date:** [June 1, 2018, 2:18am UTC](https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012/3 "2018-06-01T02:18:04Z")

</div>

logs don't denote some errors. And output setting is correct. Filebeat send new access logs with small size successfully. I think less max\_retries may be this issue's reason, I will set max\_retries a large number, hoping that works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2018, 2:18am UTC](https://discuss.elastic.co/t/filebeat-cant-send-large-log-data-to-es/134012/4 "2018-06-29T02:18:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.