When Filebeat uses “TCP input”, you can set the option "max_message_size" as maximum size in bytes of the message received over TCP. But, there is another option that limits the message size when Filebeat calls "scanner.Scan()" to collect data: "MaxScanTokenSize", the meaning of this option is the maximum size used to buffer a message. Filebeat does not override "MaxScanTokenSize" with "max_message_size", which causes an error when the value of "max_message_size" we set is greater than "MaxScanTokenSize" and the length of our message is greater than "MaxScanTokenSize" and less than "max_message_size". (position: filebeat/inputsource/tcp) . beats version: 6.5.4, but 7.0 also has this problem.
This looks like a bug to me. Can you open an bug report please: https://github.com/elastic/beats/issues/new/choose
1 Like
Thank you for your reply. I have already reported it.
https://github.com/elastic/beats/issues/11966
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.