Filebeat multiline processor missing max_bytes limit

Filebeat multiline processor missing size limit

The goal is to prevent unbounded memory consumption when processing multiline log events that lack a matching end pattern. Currently Filebeat buffers each multiline event in memory until the end pattern is found, with no configurable maximum byte count or timeout. This leaves deployments vulnerable to out‑of‑memory conditions when encountering extremely long lines or malformed input.

Because the multiline configuration exposes start_pattern, match, and end_pattern but omits a max_bytes or timeout option, operators must rely on external preprocessors or custom patches to enforce limits.

Should Filebeat add a configurable max_bytes limit to the multiline processor? Should it also provide a timeout mechanism to discard stale buffers? What action should Filebeat take when a limit is exceeded—drop the event, truncate it, or emit an error?