# Max\_bytes and multilines **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 31, 2017, 12:15pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884 "2017-10-31T12:15:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![vkakhnych](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vkakhnych/32/23344_2.png) [@vkakhnych](https://discuss.elastic.co/u/vkakhnych)\ **Post date:** [October 31, 2017, 12:15pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/1 "2017-10-31T12:15:32Z")
`max_bytes` works fine on input messages but after applying `multiline` filter all new line bytes in original message replacing by two printable bytes: `\n` and we get a little larger size of message that we send further. Is it possible to apply `max_bytes` after `multiline` filter to get exactly size of result message? Thanks! ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [November 1, 2017, 12:13pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/2 "2017-11-01T12:13:30Z")
The reader in filebeat applies the `max_bytes` setting after `multiline`. The multiline reader joins/normalizes multiline events by joining the actual lines using a single newline symbol `\n`. The input processing pipeline is [build here](https://github.com/elastic/beats/blob/master/filebeat/prospector/log/harvester.go#L482). ---
**Author:** ![vkakhnych](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vkakhnych/32/23344_2.png) [@vkakhnych](https://discuss.elastic.co/u/vkakhnych)\ **Post date:** [November 1, 2017, 12:59pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/3 "2017-11-01T12:59:10Z")
Ok, but it doesn't change anything. The reason is to get in logstash/es after filebeat not more than exactly set in `max_bytes` size of message. Now I can't rely on that size and have to reduce it a little. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [November 1, 2017, 1:16pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/4 "2017-11-01T13:16:34Z")
Hm... maybe I didn't really understand your issue. `max_bytes` is already applied after mulitline processing. The message contents is not be bigger then `max_bytes` when being passed to the output. Only reason the message output can become bigger is some characters requiring some special (multi-byte) encoding. Plus, beats send additional meta-data in a json document with the actual contents. The full event will be bigger then the original log line. ---
**Author:** ![vkakhnych](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vkakhnych/32/23344_2.png) [@vkakhnych](https://discuss.elastic.co/u/vkakhnych)\ **Post date:** [November 1, 2017, 1:35pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/5 "2017-11-01T13:35:40Z")
It is exactly `\n` symbols. 2 bytes because of printable symbols instead of 1 byte in source message. But if I set `max_bytes: 6144` I want to have 6144 bytes max message in logstash. Not 6145, not 6146, etc (depends on number of new lines). Sending 10K bytes message to filebeat and get 6156 bytes in logstash. Replacing all `\n` by `\` and have exactly 6144 bytes. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [November 2, 2017, 11:52am UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/6 "2017-11-02T11:52:05Z")
It is the JSON encoding escaping special symbols. This is on network level only. Logstash does decode the message, resolving these special symbols -\> After decoding `\n` takes only 1 byte. ---
**Author:** ![vkakhnych](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vkakhnych/32/23344_2.png) [@vkakhnych](https://discuss.elastic.co/u/vkakhnych)\ **Post date:** [November 2, 2017, 12:28pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/7 "2017-11-02T12:28:33Z")
Right, but the question is still the same - can we apply `max_bytes` filter _after_ that escaping? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 30, 2017, 12:28pm UTC](https://discuss.elastic.co/t/max-bytes-and-multilines/105884/8 "2017-11-30T12:28:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.