# Filebeat: large json log will case OOM killed by k8s

**URL:** <https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240>\
**Category:** Beats\
**Created:** [July 17, 2018, 2:56am UTC](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240 "2018-07-17T02:56:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wklken](https://avatars.discourse-cdn.com/v4/letter/w/cab0a1/32.png) [@wklken](https://discuss.elastic.co/u/wklken)\
**Post date:** [July 17, 2018, 2:56am UTC](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240/1 "2018-07-17T02:56:45Z")

</div>

Hi,

Currently, I met a problem with the json log with max\_bytes limit.

filebeat.yml

```auto
    # 100KB
    max_bytes: 102400

    json.message_key: message
    json.add_error_key: true

```

then I run it on k8s with memory limit: `200Mi`

when one large JSON log: 1 single line, 50M, JSON format.

The filebeat will be killed by k8s because of the memory. And rescheduled, start, then be killed again.

I read the doc, and is the process order `decode the JSON -> multiline -> max_bytes`?

Is there any other way to avoid this, truncate the log into `max_bytes` before JSON decode?

thanks!

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 17, 2018, 7:59am UTC](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240/2 "2018-07-17T07:59:37Z")

</div>

Yes, it's like that

> <https://github.com/elastic/beats/blob/ed42bb85e72ae58cc09748dc1825159713e0ffd4/filebeat/input/log/harvester.go#L520>

You can create an [enhancement request](https://github.com/elastic/beats/issues/new) with this problem and see if we can come up with a better solution.

---

<div class="post-metadata">

**Author:** ![wklken](https://avatars.discourse-cdn.com/v4/letter/w/cab0a1/32.png) [@wklken](https://discuss.elastic.co/u/wklken)\
**Post date:** [July 17, 2018, 9:00am UTC](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240/3 "2018-07-17T09:00:56Z")

</div>

Thank you! It helps a lot!

---

<div class="post-metadata">

**Author:** ![wklken](https://avatars.discourse-cdn.com/v4/letter/w/cab0a1/32.png) [@wklken](https://discuss.elastic.co/u/wklken)\
**Post date:** [July 27, 2018, 3:13am UTC](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240/5 "2018-07-27T03:13:47Z")

</div>

I have added few codes to support the feature `maxLineBytes` limit. (the value of maxLineBytes from config is not added yet)

I have already done some test manually, and put that into our testing environment.

I'm wondering if that a common issue, should I take more time to finish it and make a pr

> <https://github.com/wklken/beats/commit/95a0f2d964e0e45b81a8b6766c6b046c1233605d>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2018, 5:13am UTC](https://discuss.elastic.co/t/filebeat-large-json-log-will-case-oom-killed-by-k8s/140240/6 "2018-08-24T05:13:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.