Reaching 256KB Limit when log forwarding to CloudWatch in RHOCP 4

Solution Verified - Updated -

Issue

  • Encountering an issue when log forwarding logs that exceed the 256kb limit size
  • Limit similar to Loki's described in Red Hat Knowledge Base article 7098708, but when log forwarding to CloudWatch

  • Some logs are not log forwarded by the collector to CloudWatch and it's observed the error:

    2025-03-26T09:00:01.785070422Z 2025-03-26T09:00:01.785027Z ERROR sink{component_kind="sink" component_id=output_cloudwatch component_type=aws_cloudwatch_logs}: vector::internal_events::aws_cloudwatch_logs: Encoded event is too long. size=1940901 max_size=262094 error_code="message_too_long" error_type="encoder_failed" stage="processing" internal_log_rate_limit=true

Environment

  • Red OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat OpenShift Logging (RHOL)
    • 5
    • 6
  • Vector
  • Amazon CloudWatch Logs

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content