# How to manage large messages with a few memory?

**URL:** <https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677>\
**Category:** Logstash\
**Created:** [November 8, 2021, 8:11pm UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677 "2021-11-08T20:11:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jesus\_Alberto\_Carril](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jesus_alberto_carril/32/96857_2.png) [@Jesus\_Alberto\_Carril](https://discuss.elastic.co/u/Jesus_Alberto_Carril)\
**Post date:** [November 8, 2021, 8:11pm UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677/1 "2021-11-08T20:11:56Z")

</div>

I have a problem. My JVM logstash only has 512M in it configurations:  
-Xms256m  
-Xmx512m

Logstash read messages from mylog.json and send them to my broker. BUT when a super large message is written in my mylog.json the logstash JVM throws a java.lang.OutOfMemoryError: Java heap space. If I increase the JVM memory this works fine BUT I can not increase more memory.

configuration.conf

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0da8a693c7e1d75b043e0c2ad220c652d924a5d1.png)

What can I do?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 8, 2021, 9:20pm UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677/2 "2021-11-08T21:20:19Z")

</div>

You could try to decrease the number of events that logstash process adjusting both the number of workers and the batch size.

Per default the `pipeline.workers` is set to the same number of CPU cores in your host and the `pipeline.batch.size` is set to `125`, you will need to change those values until you find a combination that won't give you OOM errors.

You can find more information about those settings in the [documentation](https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html#logstash-settings-file).

---

<div class="post-metadata">

**Author:** ![Jesus\_Alberto\_Carril](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jesus_alberto_carril/32/96857_2.png) [@Jesus\_Alberto\_Carril](https://discuss.elastic.co/u/Jesus_Alberto_Carril)\
**Post date:** [November 8, 2021, 10:30pm UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677/3 "2021-11-08T22:30:12Z")

</div>

Thank you for your reply. Should I increase workers and batch size or reduce?

---

<div class="post-metadata">

**Author:** ![Jesus\_Alberto\_Carril](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jesus_alberto_carril/32/96857_2.png) [@Jesus\_Alberto\_Carril](https://discuss.elastic.co/u/Jesus_Alberto_Carril)\
**Post date:** [November 9, 2021, 12:06am UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677/4 "2021-11-09T00:06:51Z")

</div>

Ive tried increasing and reducing this values and the same error appears. What else can I try?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 9, 2021, 3:55am UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677/5 "2021-11-09T03:55:17Z")

</div>

You should reduce both, but there is not much else you can do as 512 MB is already small.

You can try to use persistent queues, this way logstash will not use the in-memory queue for the events, this part explains how to configure the [persistent queue](https://www.elastic.co/guide/en/logstash/current/persistent-queues.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2021, 3:55am UTC](https://discuss.elastic.co/t/how-to-manage-large-messages-with-a-few-memory/288677/6 "2021-12-07T03:55:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
