Limit number of bytes read from a file

Elastic Stack Beats
1

Is there an option which can limit the number of bytes to be read from a file ?
Some of the users are creating jobs that has very large log files and in that case i do not
want to index all data but limit to a specific total_bytes value for that file.

I have looked at the exclude_lines and include_lines option but users can get creative and abuse the system.

Thanks
Abhi

2

I may be able to achieve it with drop event processor (https://www.elastic.co/guide/en/beats/filebeat/master/drop-event.html)

3

processors:
- drop_event:
when:
range:
log.offset.gte: 1048550

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.