Using filebeat v1.0.0~rc2 on Ubuntu 12.04.3 LTS, our large php-error log entries are getting truncated. The log entries are typically between 3k and 8k, common ones are around 4k. The first 1024 bytes is what seems to be getting cut off.
At first thought it was network or logstash related, I took those out of the picture by using the file output in filebeat to send the log output directly to a file on the server where filebeat is installed and watching the php_error log.
Is this a known issue, how can we be sure the entire entry is sent without getting truncated?
filebeat config on problem host :
filebeat: prospectors: - paths: - /mnt/log/php_errors.log encoding: utf-8 input_type: log harvester_buffer_size: 16384 registry_file: /var/lib/filebeat/registry output: file: path: "/tmp/filebeat.local.log" filename: filebeat rotate_every_kb: 10000 number_of_files: 7 shipper: logging: files: