I was getting an error in logstash like
|
1 2 3 |
Error: Your application used more memory than the safety cap of 500M. |
Since I have moved the multiline stuff to filebeat I guessed this was caused overtime by very long messages. Decided to truncate the long messages.
This is how I do it for now. I know logstash has a truncate plugin but didn’t want to install an additional plugin just for that.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
filter { if [type] == "logtype" { ruby { code => 'event.set("message", event.get("message")[0..20000]) if event.get("message").length > 20000' } grok { parse stuff... } } } |