- Does elastic-agent 8.9.0 have the fix in PR 34911 ?
Yes it does, you can see the tags that include it on the merge commit Split large batches on error instead of dropping them (#34911) · elastic/beats@df59745 · GitHub
Is this fix working properly?
It doesn't appear to be having any effect here, and from what you've posted I suspect the reason might be that Elastic Agent isn't actually seeing the HTTP 413 response and is instead seeing write tcp [redacted]:33430->[redacted]:443: write: broken pipe as the error. The new code won't do anything unless it explicitly receives a 413 from Elasticsearch.
- How do I tell how large the payload that libbeat is trying to send to elasticsearch via a
POST _bulkAPI call?
Ideally by getting a 413 response back
- Does libbeat ignore the setting of
http.max_content_lengthon the server?
Yes because it doesn't know about it. Libbeat does not query this parameter and Elasticsearch does not give it back.