Hello,
I think I have found an issue with the TCP input module of the Filebeat. When I tried to send multiple long json messages as a batch, while some of them are really long (like 7.5K characters), I got an error in my client:
Unable to write data to the transport connection: An existing connection was forcibly closed by the remote host.
In the Filebeat log file there are logs:
DEBUG [tcp] tcp/server.go:127 Client error {"address": "localhost:9123", "error": "bufio.Scanner: token too long"}
DEBUG [tcp] tcp/server.go:137 Client disconnected {"address": "localhost:9123", "remote_address": "127.0.0.1:53096", "total": 2}
I think the problem is with the splitter and the MaxScanTokenSize property (which is equal to 64 * 1024 as default).
(Golang : Read large file with bufio.Scanner cause token too long error)
I am also using the file input and everything is working fine.
I think there should be additional configuration in the TCP Input that will allow users to adjust this limit.
Kind regards,
Michal