Logstash Error 413

[bhargav_bharat]

Hello,

I am facing below mentioned error and logstash stop sending log to elasticsearch and communication also broken.

###########################################################

Jan 22 10:21:33 logstash_agent logstash[29058]: [2020-01-22T10:21:33,304][ERROR][logstash.outputs.elasticsearch][main] Encountered a retryable error.
Will Retryable error. Will Retry with exponential backoff {:code=>413, :url=>"htps://elasticsearc_IP:9202/_bulk"}

###########################################################
Any help will be appreciated:

[Badger]

@bhargav_bharat

htps://elasticsearc_IP:9202/_bulk

Really? htps?

[yaauie (Ry Biesemeyer)]

HTTP defines error code 413:

413 Payload Too Large

The 413 (Payload Too Large) status code indicates that the server is refusing to process a request because the request payload is larger than the server is willing or able to process. The server MAY close the connection to prevent the client from continuing the request. If the condition is temporary, the server SHOULD generate a Retry-After header field to indicate that it is temporary and after what time the client MAY try again.
-- RFC7231 6.5.11

This response code may be coming from Elasticsearch (e.g, if the payload being sent is larger than http.max_content_length setting), or from an intermediate http proxy that also safeguards payload size.

The Elasticsearch Output Plugin for Logstash will by default batch multiple events into _bulk requests, but will only do so if it can keep the total batch size under 20MB (when it encounters a single event that is larger than 20MB, it is sent on its own).