Fix logstash default bulk max size (elastic#1828)

CHANGELOG.asciidoc

@@ -27,6 +27,7 @@ https://github.com/elastic/beats/compare/v1.2.3...1.3[Check the HEAD diff]
 
 *Affecting all Beats*
 - Fix output modes backoff counter reset. {issue}1803[1803] {pull}1814[1814] {pull}1818[1818]
+- Set logstash output default bulk_max_size to 2048. {issue}1662[1662]
 
 - Drain response buffers when pipelining is used by redis output. {pull}1353[1353]
 - Unterminated environment variable expressions in config files will now cause an error {pull}1389[1389]

filebeat/etc/filebeat.yml

@@ -282,6 +282,10 @@ output:
     # Number of workers per Logstash host.
     #worker: 1
 
+    # The maximum number of events to bulk into a single batch window. The
+    # default is 2048.
+    #bulk_max_size: 2048
+
     # Set gzip compression level.
     #compression_level: 3
 

libbeat/etc/libbeat.yml

@@ -111,6 +111,10 @@ output:
     # Number of workers per Logstash host.
     #worker: 1
 
+    # The maximum number of events to bulk into a single batch window. The
+    # default is 2048.
+    #bulk_max_size: 2048
+
     # Set gzip compression level.
     #compression_level: 3
 

libbeat/outputs/logstash/logstash.go

@@ -44,7 +44,7 @@ const (
 	logstashDefaultTimeout   = 30 * time.Second
 	logstasDefaultMaxTimeout = 90 * time.Second
 	defaultSendRetries       = 3
-	defaultMaxWindowSize     = 1024
+	defaultMaxWindowSize     = 2048
 	defaultCompressionLevel  = 3
 )
 

packetbeat/etc/packetbeat.yml

@@ -250,6 +250,10 @@ output:
     # Number of workers per Logstash host.
     #worker: 1
 
+    # The maximum number of events to bulk into a single batch window. The
+    # default is 2048.
+    #bulk_max_size: 2048
+
     # Set gzip compression level.
     #compression_level: 3
 

topbeat/etc/topbeat.yml

@@ -137,6 +137,10 @@ output:
     # Number of workers per Logstash host.
     #worker: 1
 
+    # The maximum number of events to bulk into a single batch window. The
+    # default is 2048.
+    #bulk_max_size: 2048
+
     # Set gzip compression level.
     #compression_level: 3
 

winlogbeat/etc/winlogbeat.yml

@@ -136,6 +136,10 @@ output:
     # Number of workers per Logstash host.
     #worker: 1
 
+    # The maximum number of events to bulk into a single batch window. The
+    # default is 2048.
+    #bulk_max_size: 2048
+
     # Set gzip compression level.
     #compression_level: 3