# Filebeat output.elasticsearch 4096-byte socket writes

**URL:** <https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 13, 2017, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537 "2017-01-13T15:27:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![max0x7ba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max0x7ba/32/13344_2.png) [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\
**Post date:** [January 13, 2017, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537/1 "2017-01-13T15:27:05Z")

</div>

I notice that Filebeat does 4096-byte socket writes when sending to ElasticSearch. I cannot find a configuration option that controls this number.

Is there a way to increase the outgoing socket buffer in Filebeat, in order to minimize the number of write syscalls please?

My observations with `strace`:

```
15:18:50.744393 write(16, "POST /_bulk HTTP/1.1\r\nHost: quor"..., 4096) = 4096
15:18:50.744477 write(16, "\214\325\300Mj\304k\233\267>Vwj\306\250\nK\200\242\30\25jm#x\20c\247\3267\202\7"..., 4096) = 4096
15:18:50.744542 write(16, "r\31\25\364\211\301\262\345\334\263{\10\253\354c\375\301\0021\242}\356\270a;\n\200\213\r\333.\0"..., 4096) = 4096
15:18:50.744572 write(16, "D\5'-p\344\231cD\36]\246\325\0\0\0\0\377\377\32\2156\334\303\304\203t\367\f\0\0\0"..., 4096) = 4096
15:18:50.744588 write(16, "\24307\210\231\240o\20C\237\01707F\33\0365\261 qx\324\310\220\320|\200\202\261\211\221\201"..., 4096) = 4096
15:18:50.744602 write(16, "\213nM~\233d\2705X\225G\317\20j\22\32m\270{\27j\3221&\324\244\373\234P\2234n"..., 4096) = 4096
15:18:50.744616 write(16, "\316\264/0\314Bz_#I^\364\336z\216\7\356g\\\2m|m\323\4\227\20\215\260.\362\366"..., 4096) = 4096
15:18:50.744630 write(16, "\334\334\34\307z\23\312ND253\266022\306z\"\222\205\261%D\16=_\33\233\231\232["..., 4096) = 4096
15:18:50.744644 write(16, "\26503\2650\305&D\247<\17\0\0\0\377\377\314\235K\n\300 \fDo$\371\231\304\353\364\376"..., 4096) = 4096
15:18:50.744663 write(16, "\313#v\222D\33b\317D\210\212\231I\306#2\252|\236\207\343\351\211\341/\245\222\375\1\0\0\377"..., 4096) = 4096
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 16, 2017, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537/2 "2017-01-16T14:13:49Z")

</div>

the default buffer size is currently not configurable. Feel free to [open an enhancement request](https://github.com/elastic/beats/issues).

---

<div class="post-metadata">

**Author:** ![max0x7ba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max0x7ba/32/13344_2.png) [@max0x7ba](https://discuss.elastic.co/u/max0x7ba)\
**Post date:** [January 16, 2017, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537/3 "2017-01-16T14:34:01Z")

</div>

Done: [https://github.com/elastic/beats/issues/3381](https://github.com/elastic/beats/issues/3381)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2017, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-output-elasticsearch-4096-byte-socket-writes/71537/4 "2017-02-13T14:34:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.