I am using Filebeat to send events to Logstash. Filebeat's internal queue has been configured so that events will be combined into events before being sent to the logstash output. I've modified pipeline.batch.size and pipeline.batch.delay as well as numerous other options in logstash.yml and filebeat.yml. Having specified json_batch in my logstash conf file the output being sent via the http output plugin is being wrapped in array brackets. The issue I'm facing however is that in rare occurrences those brackets contain two JSON objects and in the majority of cases the brackets only contain one object. I would like to configure the batching so that I can control the number of objects in each request. How is this possible and why am I seeing the behavior that I'm experiencing?
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.