Logstash是否对每个事件消息都有限制大小? [英] Does Logstash has a limit size for each event-message?

问题描述

我正在公司服务的服务器上实施监视工具.为此，我正在使用logstash.我们的应用程序通过log4net udp附加器将其日志发送到logstash(输入udp)，然后使用logstash取消日志，然后将其发送到elasticsearch.当我在kibana中显示日志时，我看到一些日志被截断了，最后一个主要部分丢失了(对于大日志).所以我的问题是，Logstash是否对收到的每个消息事件都有大小限制.如果是，可以增加尺寸.我需要我所有的日志，而且都没有被截断.

I am implementing a monitoring tool on servers of my company service. To do that, I am using logstash. Our applications send their logs via a log4net udp appender to logstash (input udp) and then logstash grok them, and send them to elasticsearch. When I display my logs in kibana, I see that some logs are truncated, the last main part is missing (for big logs). So my question is, does Logstash has a size limit for each message-event received. If yes, is it possible to increase the size. I need all my logs and none of them truncated.

推荐答案

对于udp，我认为已经找到了解决方案: -增加udp.rb文件中的buffer_size参数.

For the udp case, I think that I have found the solution : -increase the buffer_size parameter in udp.rb file.

我现在无法对其进行测试，但是我会告诉您是否可行.

I cannot test it now, but I will tell you if it works.

这篇关于Logstash是否对每个事件消息都有限制大小?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！