Logstash Event Size

Can anyone tell me how I can get the size of an entire event using the ruby filter please?


It really depends what you mean by the 'size of an entire event'. See here and here.

I'm interested in the size in bytes of the event as it will be shipped to elasticsearch. I imagine the serialisation approach may be best for that. Is that a super expensive operation to perform?

One issue that I can foresee with this is that I will be serialising metadata too. I want to get the size of the log event only, if possible.

You could try

ruby { code => ' event.set("[@metadata][eventSize]", event.to_json.length) ' }

I would not call it super expensive, but your judgement may differ.