It is exactly \n symbols. 2 bytes because of printable symbols instead of 1 byte in source message. But if I set max_bytes: 6144 I want to have 6144 bytes max message in logstash. Not 6145, not 6146, etc (depends on number of new lines). Sending 10K bytes message to filebeat and get 6156 bytes in logstash. Replacing all \n by \ and have exactly 6144 bytes.