Filebeat output.elasticsearch 4096-byte socket writes

I notice that Filebeat does 4096-byte socket writes when sending to ElasticSearch. I cannot find a configuration option that controls this number.

Is there a way to increase the outgoing socket buffer in Filebeat, in order to minimize the number of write syscalls please?

My observations with strace:

15:18:50.744393 write(16, "POST /_bulk HTTP/1.1\r\nHost: quor"..., 4096) = 4096
15:18:50.744477 write(16, "\214\325\300Mj\304k\233\267>Vwj\306\250\nK\200\242\30\25jm#x\20c\247\3267\202\7"..., 4096) = 4096
15:18:50.744542 write(16, "r\31\25\364\211\301\262\345\334\263{\10\253\354c\375\301\0021\242}\356\270a;\n\200\213\r\333.\0"..., 4096) = 4096
15:18:50.744572 write(16, "D\5'-p\344\231cD\36]\246\325\0\0\0\0\377\377\32\2156\334\303\304\203t\367\f\0\0\0"..., 4096) = 4096
15:18:50.744588 write(16, "\24307\210\231\240o\20C\237\01707F\33\0365\261 qx\324\310\220\320|\200\202\261\211\221\201"..., 4096) = 4096
15:18:50.744602 write(16, "\213nM~\233d\2705X\225G\317\20j\22\32m\270{\27j\3221&\324\244\373\234P\2234n"..., 4096) = 4096
15:18:50.744616 write(16, "\316\264/0\314Bz_#I^\364\336z\216\7\356g\\\2m|m\323\4\227\20\215\260.\362\366"..., 4096) = 4096
15:18:50.744630 write(16, "\334\334\34\307z\23\312ND253\266022\306z\"\222\205\261%D\16=_\33\233\231\232["..., 4096) = 4096
15:18:50.744644 write(16, "\26503\2650\305&D\247<\17\0\0\0\377\377\314\235K\n\300 \fDo$\371\231\304\353\364\376"..., 4096) = 4096
15:18:50.744663 write(16, "\313#v\222D\33b\317D\210\212\231I\306#2\252|\236\207\343\351\211\341/\245\222\375\1\0\0\377"..., 4096) = 4096

the default buffer size is currently not configurable. Feel free to open an enhancement request.

Done: https://github.com/elastic/beats/issues/3381

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.