Logstash Event Size

Elastic Stack Logstash
1

Hi,
Can anyone tell me how I can get the size of an entire event using the ruby filter please?

Thx
D

2

It really depends what you mean by the 'size of an entire event'. See here and here.

3

I'm interested in the size in bytes of the event as it will be shipped to elasticsearch. I imagine the serialisation approach may be best for that. Is that a super expensive operation to perform?

4

One issue that I can foresee with this is that I will be serialising metadata too. I want to get the size of the log event only, if possible.

5

You could try

ruby { code => ' event.set("[@metadata][eventSize]", event.to_json.length) ' }

I would not call it super expensive, but your judgement may differ.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.