Change Logstash UDP default size limit

[domenkozar]

UDP RFC relevant text:

A field that specifies the length in bytes of the UDP header and UDP data. The minimum length is 8 bytes since that's the length of the header. The field size sets a theoretical limit of 65,535 bytes (8 byte header + 65,527 bytes of data) for a UDP datagram. The practical limit for the data length which is imposed by the underlying IPv4 protocol is 65,507 bytes (65,535 − 8 byte UDP header − 20 byte IP header).[2]

I propose to raise the default limit of UDP buffer to 65,507 bytes.

[jordansissel]

@iElectric has this negatively impacted you?

[domenkozar]

Yes, I spend a few hours on chasing a bug. I've fixed the bug on the client side to split messages, but then logstash was parsing JSON in a weird way if it hit the 8k limit.

[jordansissel]

Did changing the read size in logstash fix your issue?

[domenkozar]

Yes. But I see no reason why not to default to RFC value to prevent such issues.

[domenkozar]

Also see https://logstash.jira.com/browse/LOGSTASH-1973

[jordansissel]

@iElectric sorry, I'm not trying to be combative - just making sure that the proposed fix would resolve your problems. Thanks for clarifying :)

[domenkozar]

🍻

[jordansissel]

For Logstash 1.5.0, we've moved all plugins to individual repositories, so I have moved this issue to logstash-plugins/logstash-input-udp#1. Let's continue the discussion there! :)