# Handle Large Messages in Logstash

**URL:** <https://discuss.elastic.co/t/handle-large-messages-in-logstash/171229>\
**Category:** Logstash\
**Created:** [March 7, 2019, 5:58am UTC](https://discuss.elastic.co/t/handle-large-messages-in-logstash/171229 "2019-03-07T05:58:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AMITH1284](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@AMITH1284](https://discuss.elastic.co/u/AMITH1284)\
**Post date:** [March 7, 2019, 5:58am UTC](https://discuss.elastic.co/t/handle-large-messages-in-logstash/171229/1 "2019-03-07T05:58:25Z")

</div>

Hello. i am using multiline patterns in my logstash input, it works well. sometimes i have very large logs say 20MB, logstash is crashing when this logs comes in. is there a way to handle it?  
i am also using grok patterns on the message.

Thanks  
Amith

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 7, 2019, 7:08am UTC](https://discuss.elastic.co/t/handle-large-messages-in-logstash/171229/2 "2019-03-07T07:08:58Z")

</div>

Why do you have such large messages? What does it contain?

Even if you manage to pass this through Logstash, what effect will it have on Elasticsearch when you try to retrieve this through Kibana?

---

<div class="post-metadata">

**Author:** ![AMITH1284](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@AMITH1284](https://discuss.elastic.co/u/AMITH1284)\
**Post date:** [March 7, 2019, 9:46am UTC](https://discuss.elastic.co/t/handle-large-messages-in-logstash/171229/3 "2019-03-07T09:46:05Z")

</div>

For now, i am dropping logs greater than 2 mb when sending logs by using `max_request_size` option. is there a way for preventing the logs to go through the grok pattern filter based on the size ?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2019, 9:46am UTC](https://discuss.elastic.co/t/handle-large-messages-in-logstash/171229/4 "2019-04-04T09:46:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.