Investigate if the parsers from the Log/Container inputs obey max-bytes
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
This is a follow up from https://github.com/elastic/beats/issues/49259. The Docker pasrser used by the Container input was not respecting the `max_bytes` setting when reading CRI partial lines.
At least the JSON reader does not seem to enforce the message size (see @andrzej-stencel's comment https://github.com/elastic/beats/pull/49743#pullrequestreview-4049636411) and it can add the message into any field (configurable), while the `LimitReader` only looks at the size of `message.Content`.
This issue is about investigating the behaviour of the different parsers when reading messages that exceed `max_bytes` and ensure Filebeat will not load messages of unlimited size into memory.
Contributor guide
Assessment
This issue has not been assessed yet.