Logstash truncate messages with more than 30 kb

Elastic Stack Logstash
1

Hi all
Im sending messages from filebeat to logstash, but the messages are more longers than 30 kb.
Logstash is truncating the messages and I can't process complete.
It's possible to increase this limit?

beats {
port => 5045
}

That is my config

Thanks

2

Actually LS do not truncate, your message has been truncated on FB side.
Go to the filebeat.yml, review params:

  • multiline.max_lines - The default is 500
  • max_bytes: The default is 10485760 bytes
  • max_message_size - depend on plugin
  • harvester_buffer_size - The default is 16384 bytes bytes

Check FB reference.

3

Thanks @Rios
I changed the max_lines params and I'm testing right now.
Regards