# Filebeat tls: oversized record received with length 20527

**URL:** <https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312>\
**Category:** Beats\
**Created:** [August 30, 2016, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312 "2016-08-30T12:46:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mha](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@mha](https://discuss.elastic.co/u/mha)\
**Post date:** [August 30, 2016, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312/1 "2016-08-30T12:46:08Z")

</div>

Hi

I'm trying to use filebeat to push logs from centos 7 to AWS ElasticSearch service. AWS forces me to use https:  
hosts: ["https://search-.....-west-1.es.amazonaws.com:80/"]  
filebeat fails with:  
2016-08-30T12:43:28Z INFO Connecting error publishing events (retrying): Head https://search-......-west-1.es.amazonaws.com:80/: tls: oversized record received with length 20527

Any ideas?

Best

Mikolaj

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 30, 2016, 2:42pm UTC](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312/2 "2016-08-30T14:42:16Z")

</div>

It seems like AWS has some limits on the size of the requests: [http://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-limits.html](http://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-limits.html) As an alternative there is our own cloud offering 😉 [https://www.elastic.co/cloud](https://www.elastic.co/cloud)

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [August 30, 2016, 9:09pm UTC](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312/3 "2016-08-30T21:09:21Z")

</div>

This is really weird. But I've no idea about AWS. Beats send a HEAD request on startup to check remote is actually available. The request does not contain any payload, as well as the response. Server should respond with `200 OK`. only.

Is the port number `80` really correct? I'd assume port `80` to be unencrypted. For `https` there might be another port to use (check AWS docs)?

---

<div class="post-metadata">

**Author:** ![mha](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@mha](https://discuss.elastic.co/u/mha)\
**Post date:** [August 31, 2016, 6:44am UTC](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312/4 "2016-08-31T06:44:30Z")

</div>

It was misconfiguration issue. I've set port to 443 and protocol: "https" and it's working correctly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2016, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-tls-oversized-record-received-with-length-20527/59312/5 "2016-09-20T12:46:15Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.