# Multiline: flush downstream error java.io.IOException since upgrading from 6.8 to 7.12

**URL:** <https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236>\
**Category:** Logstash\
**Created:** [May 27, 2021, 4:05pm UTC](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236 "2021-05-27T16:05:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![soulless](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@soulless](https://discuss.elastic.co/u/soulless)\
**Post date:** [May 27, 2021, 4:05pm UTC](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236/1 "2021-05-27T16:05:49Z")

</div>

We have a multiline config that we use for capturing exceptions.

```
codec => multiline {
    pattern => "^%{TIMESTAMP_ISO8601}"
    negate => true
    what => "previous"
}

```

It appears to still be working, but since upgrading from logstash 6.8.10 to 7.12.1, we get the following error repeatedly:

```
 Multiline: flush downstream error {:exception=>#<IOError: java.io.IOException: data to be written is bigger than page capacity>}

```

We use all the default settings in logstash. How can we resolve this error?

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 27, 2021, 4:27pm UTC](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236/2 "2021-05-27T16:27:40Z")

</div>

> [@soulless](#):
>
> `Multiline: flush downstream error {:exception=>#<IOError: java.io.IOException: data to be written is bigger than page capacity>}`

This error is telling you that the persistent queue is trying to persist an event that is larger than the queue.page\_capacity. The default value for that is 64 Mb. The default max\_bytes for a multiline codec is 10 Mb, so it would appear you have reduced the page\_capacity. Increase it.

---

<div class="post-metadata">

**Author:** ![soulless](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@soulless](https://discuss.elastic.co/u/soulless)\
**Post date:** [May 28, 2021, 7:25am UTC](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236/3 "2021-05-28T07:25:43Z")

</div>

Thanks, but I don't think that is it as we are using all the default configuration for logstash so the page size is 64Mb.

I also don't see where the large data to be written are coming from. I am tailing the log file it is using as its input and it has nothing that would trigger the multiline, but I see the error log repeatedly in the logstash log.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 28, 2021, 5:51pm UTC](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236/4 "2021-05-28T17:51:49Z")

</div>

I don't know what to say. The multiline codec is getting the error when it tries to [flush](https://github.com/logstash-plugins/logstash-codec-multiline/blob/2cf4d832c2da02eaeb617cf7a3354acde27aebe5/lib/logstash/codecs/multiline.rb#L224) the events. Reading the code, the queue will always write an element to it unless the element is larger than the page capacity.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2021, 5:52pm UTC](https://discuss.elastic.co/t/multiline-flush-downstream-error-java-io-ioexception-since-upgrading-from-6-8-to-7-12/274236/5 "2021-06-25T17:52:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.