Limiting the decanter message size for elasticsearch

[dschulten <di...@escalon.de>]

Hi,

the other we ran into a size problem with Decanter. We received the
following from ES:

<http://karaf.922171.n3.nabble.com/file/t498317/Data-too-large.png> 

Now I wonder if it is possible to limit the message size somehow. I am
unsure how it happened, apparently there was a set of log events which was
so large as the message claims (475 MB).

In org.apache.karaf.decanter.collector.elasticsearch.cfg one can define a
from and max value to "square" the query. Could that be used to prevent this
situation?

* is the *query *property necessary so that *from *and *max * can have any
effect?
* how do I define a query?
* what is a valid value for *from*? A timestamp and if so, in which format?
* can *max *be used to limit the number of log events which will be sent in
one go?

Cheers,
Dietrich




--
Sent from: http://karaf.922171.n3.nabble.com/Karaf-User-f930749.html