When filebeat harvest logs to elasticsearch ,"Failed to perform any bulk index operations: 413 Request Entity Too Large:"

Elastic Stack Beats
1

2020-03-11T09:00:51.117+0800 INFO pipeline/output.go:105 Connection to backoff(elasticsearch(http://1.2.3.4:9300)) established
2020-03-11T09:00:51.344+0800 ERROR elasticsearch/client.go:343 Failed to perform any bulk index operations: 413 Request Entity Too Large:
2020-03-11T09:00:51.714+0800 ERROR elasticsearch/client.go:343 Failed to perform any bulk index operations: Post http://1.2.3.5:9300/_bulk: net/http: HTTP/1.x transport connection broken: write tcp 1.1.1.1:64453->1.2.3.5:9300: wsasend: An existing connection was forcibly closed by the remote host.
2020-03-11T09:00:52.395+0800 ERROR elasticsearch/client.go:343 Failed to perform any bulk index operations: Post http://1.2.3.4:9300/_bulk: net/http: HTTP/1.x transport connection broken: write tcp 1.1.1.1:64454->1.2.3.4:9300: wsasend: An existing connection was forcibly closed by the remote host.
2020-03-11T09:00:52.395+0800 INFO [publisher] pipeline/retry.go:166 retryer: send wait signal to consumer
2020-03-11T09:00:52.395+0800 INFO [publisher] pipeline/retry.go:168 done

2

I assume you've to adjust the setting "http.max_content_length". Please dive into the documentation.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.