[TCP Input] Token too long


I think I have found an issue with the TCP input module of the Filebeat. When I tried to send multiple long json messages as a batch, while some of them are really long (like 7.5K characters), I got an error in my client:

Unable to write data to the transport connection: An existing connection was forcibly closed by the remote host.

In the Filebeat log file there are logs:

DEBUG [tcp] tcp/server.go:127 Client error {"address": "localhost:9123", "error": "bufio.Scanner: token too long"}
DEBUG [tcp] tcp/server.go:137 Client disconnected {"address": "localhost:9123", "remote_address": "", "total": 2}

I think the problem is with the splitter and the MaxScanTokenSize property (which is equal to 64 * 1024 as default).

I am also using the file input and everything is working fine.
I think there should be additional configuration in the TCP Input that will allow users to adjust this limit.

Kind regards,

I think you are facing this issue: https://github.com/elastic/beats/issues/11966 Correct me if I am wrong. There is a fix in progress for this: https://github.com/elastic/beats/pull/12385

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.