Updating the Maximum Event Body Size

[mitchellsuzuki]

Hi SEQ,
I am using FluentBit to send all logs from my kubernetes cluster in to SEQ using the HTTP ingestion endpoint. /ingest/clef
For the most part, it's working great. However I have a number of events that are failing to be ingested due to exceeding the maximum event body size.

How do I update this value?
For reference, I am deploying SEQ into my k8s cluster using the datalust/seq helm chart and am running the latest version 2024.3.1

Alternatively, I'd like to enable compression, however it would appear that SEQ does not currently support this.

[liammclennan]

Hi @mitchellsuzuki

Go to Settings > System and there are settings for 'Raw ingestion payload limit' and 'Raw event body limit'.

[jmsuzuki]

if I wanted to do this via api or helm installation config. how would I do this?
one of my team's requirements is "no manual steps in production".

[liammclennan]

@jmsuzuki there is the seqcli, or the HTTP API.

[jmsuzuki]

Hi Liam, from the HTTP API docs, I can't find the settings I'm looking for.

From another discussion though on the topic, I do see that you suggested using this endpoint:
/api/settings/setting-raweventmaximumcontentlength

I assume this is a PUT request like the other settings are?

Can you provide an example body for the request?

[liammclennan]

Yes, it is a PUT. Here is an example body:

{
  "Name":"raweventmaximumcontentlength",
  "Value":999999,
  "Id":"setting-raweventmaximumcontentlength",
  "Links":{"Self":"api/settings/setting-raweventmaximumcontentlength","Group":"api/settings/resources"}
}

I got this from the browser developer tools by saving the settings.

I'm not sure why it's not in the HTTP API docs - we'll get that fixed.