# Filebeat is not able to read the message event if the attachment is more than 2 GBin the log file **URL:** https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765 **Category:** Beats **Tags:** filebeat **Created:** [November 29, 2025, 8:34am UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765 "2025-11-29T08:34:51Z") **Posts on this page:** 1 **Showing post:** 5
### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb) #### Post date: [November 30, 2025, 5:27pm UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765/5 "2025-11-30T17:27:51Z")
Continued here > [@Filebeat OOM (Out Of Memory) Error](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768/8): > > Apologies... I am a bit confused are you saying that if it is possible to detect the attached content A) You want to DROP the content (PDF, DOC, etc) and NOT ingest it into elasticsearch or B) You DO want to ingest the content (PDF, DOC, etc) and DO ingest it into elasticsearch --- _[View the full topic](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765)._