# How can I increase the size of bytes that a log can have?

**URL:** https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702
**Category:** Beats
**Tags:** filebeat
**Created:** [October 3, 2022, 4:16pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702 "2022-10-03T16:16:37Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)
#### Post date: [October 3, 2022, 4:16pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/1 "2022-10-03T16:16:37Z")

</div>

I need help, I am receiving a log of 1300 lines, I am receiving a parse error, for this I did tests and these logs were significantly reduced and with that the error disappears since what I am removing does not affect the structure of the log. For which I only have one theory left... and that is that the size of my log is exceeding the limit. Use the max\_bytes: 10485760 like this:

```auto
filebeat.inputs:

- type: filestream
  id: error-app1
  enabled: true
  paths:
    - C:\Users\60085367\Desktop\ServerErrorParsi\pruebaslogs\*
  
  max_bytes: 10485760

  processors:
  - add_fields: 
      fields: 
        V_APP_NAME: error.Log.Tester1

  parsers:
    - multiline:
        type: pattern
        pattern: "^<log4j:event.*" 
        negate: true
        match: after

```

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 3, 2022, 5:52pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/2 "2022-10-03T17:52:19Z")

</div>

> [@erwin339](#):
>
> `max_bytes`

Not sure what data do you have and which error has been shown. Just take the longest line and save in a file.  
You have this param: `multiline.max_lines: 500`

Formore info check [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-reference-yml.html).

---

<div class="post-metadata">

### Author: ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)
#### Post date: [October 3, 2022, 8:11pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/3 "2022-10-03T20:11:43Z")

</div>

I had already observed that information but I couldn't draw a conclusion since I see that they use the type syslog, tcp input, udp input. Confirm me if I'm right, for the filestream type I can only apply the max\_line inside the multiline parsers:.

I understand that for the filestream it is done like this:

```auto
  parsers:
    - multiline:
        type: pattern
        pattern: "^<log4j:event.*" 
        negate: true
        match: after
        max_line: 1500

```

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 3, 2022, 9:08pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/4 "2022-10-03T21:08:40Z")

</div>

Yes, you are using filestream. Set little more than you expect

```auto
   - multiline:
        max_line: 2500
        max_bytes: 504857600

```

Set debug mode and will see is it applied.

---

<div class="post-metadata">

### Author: ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)
#### Post date: [October 3, 2022, 9:19pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/5 "2022-10-03T21:19:34Z")

</div>

How to apply debug mode? I still don't know much about it.  
So far I have only used the command filebeat.exe -c filebeat.yml

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 3, 2022, 9:33pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/6 "2022-10-03T21:33:19Z")

</div>

This will display activities on the screen  
`filebeat.exe -c filebeat.yml -e` if you don't see then add -d "\*"  
or use log

```auto
logging.level: debug
logging.to_files: true
logging.files:
  path: /path/dir
  name: filebeat.log
  keepfiles: 7
  permissions: 0644

```

---

<div class="post-metadata">

### Author: ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)
#### Post date: [October 4, 2022, 1:45pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/7 "2022-10-04T13:45:18Z")

</div>

I got this result, but I don't see the change, the error still persists. My error is the parsers of the xml, but this is due to the fact that it does not reach the closing of the event and the message, firstly because it exceeds 500 lines.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04f5caf7dd4ae9dea4bff30cd60716a9b9c5bdcb.png)

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 4, 2022, 2:18pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/8 "2022-10-04T14:18:57Z")

</div>

Data path locked by another beat. The most likely you have left the FB service active.

---

<div class="post-metadata">

### Author: ![erwin339](https://avatars.discourse-cdn.com/v4/letter/e/2bfe46/32.png) [@erwin339](https://discuss.elastic.co/u/erwin339)
#### Post date: [October 4, 2022, 3:41pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/9 "2022-10-04T15:41:02Z")

</div>

Sorry, I already found the error. I was using max\_line and it was max\_lines....

---

<div class="post-metadata">

### Author: ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 4, 2022, 6:16pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/10 "2022-10-04T18:16:02Z")

</div>

Now is everything OK?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 1, 2022, 8:16pm UTC](https://discuss.elastic.co/t/how-can-i-increase-the-size-of-bytes-that-a-log-can-have/315702/11 "2022-11-01T20:16:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.