Max event size for tcp input plugin

[Jehutywong]

Logstash version 7.6

I am sending a big json over TCP to Logstash. Somehow only partial of the event was able to output. roughly 60KB. The rest of the event was dicarded. Any way i can increase this limit.

I tried to increase the tcp buffer size in system config (Centos7), net.ipv4.tcp_rmem, but no help.

Looks like someone had encountered the same issue before:

Maximum number of bytes for tcp input plugin

I'm using the tcp input plugin with the JSON codec to pull in JSON-formatted syslog, and when processing events, sometimes I will get some larger than 8192 bytes. When this happens, the event is split in two records (and of course, not parsed). Is there any way to raise this limit, similar to the buffer_size configuration for the udp input plugin? Cappy

[Jehutywong]

By more testing, looks like the net.ipv4.tcp_rmem and net.ipv4.tcp_wmem settings do have effect.

What I did was to increase net.ipv4.tcp_rmem min and initial values in the Logstash server, and also increased net.ipv4.tcp_wmem min and initial values in the client side.