From a90f30c10906bfa533eec622158c970173989892 Mon Sep 17 00:00:00 2001
From: Aditya Hase <aditya@adityahase.com>
Date: Wed, 22 Jan 2025 18:25:40 +0530
Subject: [PATCH] fix(filebeat): Send fewer events in each bulk api call

Large log lines grouped together (1000 at a time) create a very large payload that log server rejects
Filebeat keeps retrying this huge payload over and over again.
This causes excess bandwidth usage between db and log servers.

References:
- https://gameplan.frappe.cloud/g/space/237/discussion/3340/frappe-cloud-metrics-review-14th-january-2024?comment=12478
- https://gameplan.frappe.cloud/g/space/17/discussion/2743/aws-costs-and-blunders
---
 press/playbooks/roles/filebeat/templates/filebeat.yml  | 4 ++++
 press/press/doctype/database_server/database_server.py | 2 ++
 press/press/doctype/server/server.py                   | 1 +
 press/press/doctype/virtual_machine/virtual_machine.py | 1 +
 4 files changed, 8 insertions(+)

diff --git a/press/playbooks/roles/filebeat/templates/filebeat.yml b/press/playbooks/roles/filebeat/templates/filebeat.yml
index 502a872155..4d3e9a5623 100644
--- a/press/playbooks/roles/filebeat/templates/filebeat.yml
+++ b/press/playbooks/roles/filebeat/templates/filebeat.yml
@@ -38,6 +38,10 @@ output.elasticsearch:
   ssl.verification_mode: strict
   ssl.supported_protocols: [TLSv1.3]
 
+  {% if server_type is defined and server_type == "Datbase Server" %}
+  bulk_max_size: 10
+  {% endif %}
+
 # ================================== Logging ===================================
 
 logging.to_files: true
diff --git a/press/press/doctype/database_server/database_server.py b/press/press/doctype/database_server/database_server.py
index dba08c1adb..907d48237c 100644
--- a/press/press/doctype/database_server/database_server.py
+++ b/press/press/doctype/database_server/database_server.py
@@ -354,6 +354,7 @@ def _setup_server(self):
 				user=self.ssh_user or "root",
 				port=self.ssh_port or 22,
 				variables={
+					"server_type": self.doctype,
 					"server": self.name,
 					"workers": "2",
 					"agent_password": config.agent_password,
@@ -833,6 +834,7 @@ def _rename_server(self):
 				playbook="database_rename.yml",
 				server=self,
 				variables={
+					"server_type": self.doctype,
 					"server": self.name,
 					"workers": "2",
 					"agent_password": agent_password,
diff --git a/press/press/doctype/server/server.py b/press/press/doctype/server/server.py
index 8f1625c89b..da5bd6f8e0 100644
--- a/press/press/doctype/server/server.py
+++ b/press/press/doctype/server/server.py
@@ -398,6 +398,7 @@ def _install_filebeat(self):
 				user=self._ssh_user(),
 				port=self._ssh_port(),
 				variables={
+					"server_type": self.doctype,
 					"server": self.name,
 					"log_server": log_server,
 					"kibana_password": kibana_password,
diff --git a/press/press/doctype/virtual_machine/virtual_machine.py b/press/press/doctype/virtual_machine/virtual_machine.py
index 4d4266ecd9..c4b06b03e3 100644
--- a/press/press/doctype/virtual_machine/virtual_machine.py
+++ b/press/press/doctype/virtual_machine/virtual_machine.py
@@ -335,6 +335,7 @@ def get_cloud_init(self):
 			"filebeat_config": frappe.render_template(
 				"press/playbooks/roles/filebeat/templates/filebeat.yml",
 				{
+					"server_type": server.doctype,
 					"server": self.name,
 					"log_server": log_server,
 					"kibana_password": kibana_password,