Opensearch/Filebeat problems with more than 32K message

OpenSearch
,
1

Hi
I hope I have not missed the section for this request.

I installed a filebeat instance (version 7.17.4) on a remote machine, configured to send data to a logstash instance (version 7.16.3).
Size of messages are around 100K.

On logstash configuration, I split the XML message in order to have many document per message.

I see that logstash parse always the first 32K of message.
I don’t know if the problem is in the filebeat sending or in the logstash receinving.
I have not set any size limit in both configurations.

Thanks in advance

2

Problem solved.
There wasn’t a message size problem, but a number of line problem in a multiline Filebeat configuration.
Setting multiline.max_line to a correct value, it works correctly.