Does Logstash has a limit size for each event-message?

Question

I am implementing a monitoring tool on servers of my company service. To do that, I am using logstash. Our applications send their logs via a log4net udp appender to logstas

Answer 1

For the udp case, I think that I have found the solution : -increase the buffer_size parameter in udp.rb file.

I cannot test it now, but I will tell you if it works.

Answer 2

Logstash's property buffer_size is by default set to 8192. That's why messages sent over UDP to Logstash are truncated at 8192th symbol.

Try increasing UDP buffer_size in Logstash.

References:

• https://github.com/elastic/logstash/issues/1505
• https://github.com/elastic/logstash/issues/2111
• http://logstash.net/docs/1.4.2/inputs/udp#buffer_size (may be outdated, check documentation version)

Answer 3

Update for 2019:

The maximum size is set by the buffer_size parameter in the UDP input. https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html#plugins-inputs-udp-buffer_size

The default buffer size is:

• 65536 bytes on Logstash >= 5.1
• 8192 bytes on Logstash >= 2.0
• 4096 bytes on older versions.

A UDP datagram is limited to 65535 bytes, the length header being 16 bits.

Answer 4

I have test it with Logstash 1.4.0 and Logstash 1.3.3. I found that the maximum size of an event is 4095!

So, If your logs have larger than this size, maybe you have to split it to multiple event at the time you send the logs to logstash.