# Max event size for tcp input plugin

**URL:** <https://discuss.elastic.co/t/max-event-size-for-tcp-input-plugin/241773>\
**Category:** Logstash\
**Created:** [July 19, 2020, 8:15am UTC](https://discuss.elastic.co/t/max-event-size-for-tcp-input-plugin/241773 "2020-07-19T08:15:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Post date:** [July 19, 2020, 8:15am UTC](https://discuss.elastic.co/t/max-event-size-for-tcp-input-plugin/241773/1 "2020-07-19T08:15:52Z")

</div>

Logstash version 7.6

I am sending a big json over TCP to Logstash. Somehow only partial of the event was able to output. roughly 60KB. The rest of the event was dicarded. Any way i can increase this limit.

I tried to increase the tcp buffer size in system config (Centos7), net.ipv4.tcp\_rmem, but no help.

Looks like someone had encountered the same issue before:

> [@Maximum number of bytes for tcp input plugin](https://discuss.elastic.co/t/maximum-number-of-bytes-for-tcp-input-plugin/116733):
>
> I'm using the tcp input plugin with the JSON codec to pull in JSON-formatted syslog, and when processing events, sometimes I will get some larger than 8192 bytes. When this happens, the event is split in two records (and of course, not parsed). Is there any way to raise this limit, similar to the buffer\_size configuration for the udp input plugin? Cappy

---

<div class="post-metadata">

**Author:** ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Post date:** [July 21, 2020, 3:52pm UTC](https://discuss.elastic.co/t/max-event-size-for-tcp-input-plugin/241773/2 "2020-07-21T15:52:40Z")

</div>

By more testing, looks like the net.ipv4.tcp\_rmem and net.ipv4.tcp\_wmem settings do have effect.

What I did was to increase net.ipv4.tcp\_rmem min and initial values in the Logstash server, and also increased net.ipv4.tcp\_wmem min and initial values in the client side.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2020, 3:52pm UTC](https://discuss.elastic.co/t/max-event-size-for-tcp-input-plugin/241773/3 "2020-08-18T15:52:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.