[FATAL][logstash.inputs.udp]UDP Fatal Error: EMSGSIZE: Message too long

[Gunnerva]

For all general issues, please provide the following details for fast resolution:

• Version:
  Logstash 6.3.2
  UDP Input Plugin v3.0.6
  Logstash 6.5.4
  UPD Input v3.3.4
• Operating System:
• Config File (if you have sensitive info, please remove it):
• Sample Data:
• Steps to Reproduce:
  Send a UDP message that exceeds size. This causes a FATAL error and Logstash to exit.

Example Error:
<ip.removed> - FATAL - LogStash::Runner 1000 - - [logstash.runner] An unexpected error occurred! {:error=>#<Errno::EMSGSIZE: Message too long - No message available>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:438:in send'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-udp-3.0.6/lib/logstash/outputs/udp.rb:24:in block in register'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-codec-line-3.0.8/lib/logstash/codecs/line.rb:50:in encode'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-udp-3.0.6/lib/logstash/outputs/udp.rb:31:in receive'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:91:in block in multi_receive'", "org/jruby/RubyArray.java:1734:in each'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:91:in multi_receive'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:109:in multi_receive'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:156:in multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:475:in block in output_batch'", "org/jruby/RubyHash.java:1343:in each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:474:in output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:426:in worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:384:in block in start_workers'"]}

[adoerrES]

Workaround:

Use the truncate filter to truncate UDP events beyond the theoretical UDP limit of 64k-65k per message and avoid the issue.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-truncate.html