# Filebeat is not able to read the message event if the attachment is more than 2 GBin the log file
**URL:** https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765
**Category:** Beats
**Tags:** filebeat
**Created:** [November 29, 2025, 8:34am UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765 "2025-11-29T08:34:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)
#### Post date: [November 29, 2025, 8:34am UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765/1 "2025-11-29T08:34:52Z")
Filebeat is not able to read the message event if the attachment is more than 2 GB in in request contact the log file.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 29, 2025, 4:24pm UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765/2 "2025-11-29T16:24:55Z")
Hello,
You need to provide a lot more of context.
What is your input? Please share your entire `filebeat.yml`.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [November 29, 2025, 5:17pm UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765/3 "2025-11-29T17:17:18Z")
Maybe this can help:
`- type: filestream`
#Defines the buffer size every harvester uses when fetching the file
`harvester_buffer_size: 16384`
#Maximum number of bytes a single log event can have
#All bytes after max\_bytes are discarded and not sent. The default is 10MB.
#This is especially useful for multiline log messages which can get large.
`message_max_bytes: 10485760`
#The maximum number of lines that are combined into one event.
#In case there are more the max\_lines the additional lines are discarded.
#Default is 500
`multiline.max_lines: 500`
---
### Author:  [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)
#### Post date: [November 30, 2025, 7:56am UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765/4 "2025-11-30T07:56:55Z")
HI Rios,
this is fixed 90% issue, but i need max size, there no limitation
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [November 30, 2025, 5:27pm UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765/5 "2025-11-30T17:27:51Z")
Continued here
> [@Filebeat OOM (Out Of Memory) Error](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768/8):
>
> Apologies... I am a bit confused are you saying that if it is possible to detect the attached content A) You want to DROP the content (PDF, DOC, etc) and NOT ingest it into elasticsearch or B) You DO want to ingest the content (PDF, DOC, etc) and DO ingest it into elasticsearch
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [November 30, 2025, 5:27pm UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765/6 "2025-11-30T17:27:56Z")