# Using Filebeat with Large JSON logs

**URL:** https://discuss.elastic.co/t/using-filebeat-with-large-json-logs/268261
**Category:** Beats
**Tags:** filebeat
**Created:** [March 24, 2021, 7:58pm UTC](https://discuss.elastic.co/t/using-filebeat-with-large-json-logs/268261 "2021-03-24T19:58:48Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jamesjuxly](https://avatars.discourse-cdn.com/v4/letter/j/9fc348/32.png) [@jamesjuxly](https://discuss.elastic.co/u/jamesjuxly)
#### Post date: [March 24, 2021, 7:58pm UTC](https://discuss.elastic.co/t/using-filebeat-with-large-json-logs/268261/1 "2021-03-24T19:58:48Z")

</div>

Hello,

I'm using an ELK stack with filebeat to ship JSON logs from docker containers (kubernetes) to elastic. The problem I'm having is that large log entries seem to be skipped. Is there a setting to change to allow this to pick up ~200kb+ json objects to log?

```auto
  filebeat.yml: |-
    filebeat.config:
      inputs:
        # Mounted `filebeat-inputs` configmap:
        path: ${path.config}/inputs.d/*.yml
        # Reload inputs configs as they change:
        reload.enabled: false
      modules:
        path: ${path.config}/modules.d/*.yml
        # Reload module configs as they change:
        reload.enabled: false

    processors:
      - add_cloud_metadata: ~
      - decode_json_fields:
          when.regexp.message: '^{'
          fields: ["message"]
          target: ""
          overwrite_keys: true
      - drop_event:
          when.not.contains.message: "\"cid\":"

    output.elasticsearch:
      hosts: ["loggingelastic:9200"]

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 21, 2021, 9:58pm UTC](https://discuss.elastic.co/t/using-filebeat-with-large-json-logs/268261/2 "2021-04-21T21:58:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.