elastic / elastic/beats

Investigate if the parsers from the Log/Container inputs obey max-bytes

Open
#49,907 9 comments 0 reactions 1 assignee Claimed by @belimawr View on GitHub
bug Team:Elastic-Agent-Data-Plane
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

This is a follow up from https://github.com/elastic/beats/issues/49259. The Docker pasrser used by the Container input was not respecting the `max_bytes` setting when reading CRI partial lines.

At least the JSON reader does not seem to enforce the message size (see @andrzej-stencel's comment https://github.com/elastic/beats/pull/49743#pullrequestreview-4049636411) and it can add the message into any field (configurable), while the `LimitReader` only looks at the size of `message.Content`.

This issue is about investigating the behaviour of the different parsers when reading messages that exceed `max_bytes` and ensure Filebeat will not load messages of unlimited size into memory.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.