{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/2015","labels_url":"https://api.github.com/repos/elastic/logstash/issues/2015/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/2015/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/2015/events","html_url":"https://github.com/elastic/logstash/issues/2015","id":47716632,"number":2015,"title":"File log events get to large and exceed JVM","user":{"login":"stevemd","id":9553057,"avatar_url":"https://avatars.githubusercontent.com/u/9553057?v=3","gravatar_id":"","url":"https://api.github.com/users/stevemd","html_url":"https://github.com/stevemd","followers_url":"https://api.github.com/users/stevemd/followers","following_url":"https://api.github.com/users/stevemd/following{/other_user}","gists_url":"https://api.github.com/users/stevemd/gists{/gist_id}","starred_url":"https://api.github.com/users/stevemd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevemd/subscriptions","organizations_url":"https://api.github.com/users/stevemd/orgs","repos_url":"https://api.github.com/users/stevemd/repos","events_url":"https://api.github.com/users/stevemd/events{/privacy}","received_events_url":"https://api.github.com/users/stevemd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2014-11-04T14:08:42Z","updated_at":"2015-04-17T16:41:10Z","closed_at":null,"body":"While processing a logfile the developer placed the application in debug mode which in turn started creating mutiline events that when matched had a stream of multiple lines that appeared endless and exceeded the parser's memory capacity. \r\nI would appreciate any help to limit the size of these events (gracefully) so that no multiline event would ever exceed a specified size limit.\r\nAny ideas? \r\nI am assuming that the code will not go past the grok portion prior to collecting the entire event (which would exceed memory capacity) before I could drop it further down in the filter?\r\nUnderstanding the flow of the filter would also be useful."},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/94023880","html_url":"https://github.com/elastic/logstash/issues/2015#issuecomment-94023880","issue_url":"https://api.github.com/repos/elastic/logstash/issues/2015","id":94023880,"user":{"login":"ph","id":640,"avatar_url":"https://avatars.githubusercontent.com/u/640?v=3","gravatar_id":"","url":"https://api.github.com/users/ph","html_url":"https://github.com/ph","followers_url":"https://api.github.com/users/ph/followers","following_url":"https://api.github.com/users/ph/following{/other_user}","gists_url":"https://api.github.com/users/ph/gists{/gist_id}","starred_url":"https://api.github.com/users/ph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ph/subscriptions","organizations_url":"https://api.github.com/users/ph/orgs","repos_url":"https://api.github.com/users/ph/repos","events_url":"https://api.github.com/users/ph/events{/privacy}","received_events_url":"https://api.github.com/users/ph/received_events","type":"User","site_admin":false},"created_at":"2015-04-17T16:41:10Z","updated_at":"2015-04-17T16:41:10Z","body":"Fixed in the latest version of the multiline plugin 0.1.7, we have added a conditionals  to break on the number of lines and the number of MB, if we go over theses limits the event will be flush to queue and tagged with `multiline_codec_max_lines_reached` or `multiline_codec_max_bytes_reached` this will prevent logstash from accumulating too much events in memory."}}