# Request entity too large / error in filebeat

**URL:** <https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238>\
**Category:** Elasticsearch\
**Created:** [November 4, 2020, 9:49am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238 "2020-11-04T09:49:17Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![grynhtjnyuk](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\
**Post date:** [November 4, 2020, 9:49am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/1 "2020-11-04T09:49:17Z")

</div>

I have filebeat installed on kubernetes, and elasticsearch installed on kubernetes also.  
I got this error and I do not see logs in elasticsearch. Could you please tell me how can I solve the problem:

```
[elasticsearch]	elasticsearch/client.go:223	failed to perform any bulk index operations: 413 Request Entity Too Large: <html>
<head><title>413 Request Entity Too Large</title></head>
<body>
<center><h1>413 Request Entity Too Large</h1></center>
<hr><center>nginx/1.17.8</center>
</body>
</html>
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 4, 2020, 10:06am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/2 "2020-11-04T10:06:28Z")

</div>

What is your filebeat configuration?

---

<div class="post-metadata">

**Author:** ![grynhtjnyuk](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\
**Post date:** [November 4, 2020, 10:15am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/3 "2020-11-04T10:15:22Z")

</div>

Do you mean this:

```
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: 
  namespace: {{ .Values.namespace }}
  labels:
    k8s-app: 
data:
  filebeat.yml: |-
    filebeat.modules:
      - module: system
        syslog:
          enabled: true
          #var.paths: ["/var/log/syslog"]
        auth:
          enabled: true
          #var.paths: ["/var/log/authlog"]

    filebeat.autodiscover:
      providers:
        - type: kubernetes
          templates:
            - condition:
                equals:
                  kubernetes.namespace: {{ .Values.namespace }}
              config:
                - type: docker
                  fields:
                    installation: ${INSTALLATION_NAME}
                  containers.ids:
                    - "${data.kubernetes.container.id}"
                  multiline.pattern: '^\{'
                  multiline.negate: true
                  multiline.match: after  
                  processors:
                    - decode_json_fields:
                        fields: message
                        target: ""
                        overwrite_keys: true
                    - drop_event:
                        when.and:
                          - or:
                            - regexp:
                                "kubernetes.container.name": 
                            - regexp:
                                "kubernetes.container.name": 
                            - regexp:
                                "kubernetes.container.name": 
                          - or:
                            - equals:
                                logger_name: 
                            - equals:
                                logger_name: 
                            - equals:
                                logger_name: 
                            - equals:
                                logger_name: 
                            - equals:
                                logger_name: 
                                logger_name: 
                    - drop_fields:
                        fields: 
                         
    #filebeat.autodiscover:
    # providers:
    # - type: kubernetes
    # hints.enabled: true

    output.elasticsearch:
      hosts: {{ .Values.elastic.hosts }}
      username: {{ .Values.elastic.user }}
      password: ${ELASTICSEARCH_PASSWORD}

    logging.level: info
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 4, 2020, 10:19am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/4 "2020-11-04T10:19:14Z")

</div>

Yes I meant the `filebeat.yml` configuration which you provided.

Is there a way to run filebeat in debug mode?

See

> **[Configure logging | Filebeat Reference \[7.9\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html)**

---

<div class="post-metadata">

**Author:** ![grynhtjnyuk](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\
**Post date:** [November 4, 2020, 10:26am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/5 "2020-11-04T10:26:28Z")

</div>

I have logging level: info , which logs everything, according to the:  
info - Logs informational messages, including the number of events that are published. Also logs any warnings, errors, or critical errors.

Could you tell me which logging level you state to use ?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 4, 2020, 10:33am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/6 "2020-11-04T10:33:31Z")

</div>

`debug`

---

<div class="post-metadata">

**Author:** ![grynhtjnyuk](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\
**Post date:** [November 4, 2020, 11:37am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/7 "2020-11-04T11:37:13Z")

</div>

After setting up the debug mode I had to restart my filebeat.  
I saw that the problem gone now and I see messages on elastic, but i had the same situation yesterday. So the problem will back.  
Could you tell me please, is this option `bulk_max_size` relative to my problem ?  
The default value is 50 , so maybe increase the valuse ?

---

<div class="post-metadata">

**Author:** ![grynhtjnyuk](https://avatars.discourse-cdn.com/v4/letter/g/ee59a6/32.png) [@grynhtjnyuk](https://discuss.elastic.co/u/grynhtjnyuk)\
**Post date:** [November 4, 2020, 12:09pm UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/8 "2020-11-04T12:09:55Z")

</div>

but probably this could be better ? -\> `http.max_content_length`

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 4, 2020, 12:53pm UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/9 "2020-11-04T12:53:04Z")

</div>

> [@grynhtjnyuk](#):
>
> Could you tell me please, is this option `bulk_max_size` relative to my problem ?  
> The default value is 50 , so maybe increase the valuse ?

I'd decrease it instead.

An http request should not exceed 100mb (default limit).

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 5, 2020, 3:32am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/10 "2020-11-05T03:32:58Z")

</div>

> [@grynhtjnyuk](#):
>
> `<hr><center>nginx/1.17.8</center>`

This looks like it is coming from kubernetes, not Elasticsearch? Is there anything in the Elasticsearch logs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2020, 3:33am UTC](https://discuss.elastic.co/t/request-entity-too-large-error-in-filebeat/254238/11 "2020-12-03T03:33:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.