Increase MAX_EVENT_LEN to match current max

[ShelbyZ]

Summary

CloudWatch logs PutLogEvents API change in 2025 to support events up to 1MB (ref) while our defaults reflect the older value 256KB.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [N/A] Example configuration file for the change
• Debug log output from testing the change

Gist: https://gist.github.com/ShelbyZ/76bfac405e03723efeb532a48d5b6a87

Over-limit on current logs

2025-11-13T04:37:45.155000+00:00 fluent-bit/log-router/b5075d48a899473fb8e8acc51e786ac2 [2025/11/13 04:37:45.155344086] [ warn] [output:cloudwatch_logs:app-logs-output] [size=1047894] Truncating event which is larger than max size allowed by CloudWatch
2025-11-13T04:37:45.155000+00:00 fluent-bit/log-router/b5075d48a899473fb8e8acc51e786ac2 [2025/11/13 04:37:45.155470414] [debug] [output:cloudwatch_logs:app-logs-output] Using stream=b5075d48a899473fb8e8acc51e786ac2, group=/ecs/fluentbit-workshop-lab3/app-logs
2025-11-13T04:37:45.159000+00:00 fluent-bit/log-router/b5075d48a899473fb8e8acc51e786ac2 [2025/11/13 04:37:45.155790284] [debug] [output:cloudwatch_logs:app-logs-output] cloudwatch:PutLogEvents: events=1, payload=262280 bytes

New limit

2025-11-13T04:32:20.986000+00:00 fluent-bit/log-router/21e880b6b1774c8e8ec2a6fb6b4679ea [2025/11/13 04:32:20.986187322] [debug] [output:cloudwatch_logs:app-logs-output] Using stream=21e880b6b1774c8e8ec2a6fb6b4679ea, group=/ecs/fluentbit-workshop-lab3/app-logs
2025-11-13T04:32:20.986000+00:00 fluent-bit/log-router/21e880b6b1774c8e8ec2a6fb6b4679ea [2025/11/13 04:32:20.986606024] [debug] [output:cloudwatch_logs:app-logs-output] cloudwatch:PutLogEvents: events=1, payload=1048057 bytes
2025-11-13T04:32:20.986000+00:00 fluent-bit/log-router/21e880b6b1774c8e8ec2a6fb6b4679ea [2025/11/13 04:32:20.986614394] [debug] [output:cloudwatch_logs:app-logs-output] Sending log events to log stream 21e880b6b1774c8e8ec2a6fb6b4679ea

• [WIP] Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [N/A] Run local packaging test showing all targets (including any new ones) build.
• [N/A] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [N/A] Documentation required for this feature

Backporting

• [N/A] Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Improvements
  • Increased the maximum CloudWatch log event payload size from 256KB to 1MB, enabling larger events to be logged in a single request.

[coderabbitai]

Walkthrough

The maximum event payload size limit for CloudWatch Logs is increased from 262118 bytes (256KiB minus 26) to 1048550 bytes (1MiB minus 26), with the corresponding documentation comment updated accordingly.

Changes

Cohort / File(s)	Summary
CloudWatch API Configuration plugins/out_cloudwatch_logs/cloudwatch_api.h	Updated MAX_EVENT_LEN constant from 262118 to 1048550; updated associated comment to reflect 1MiB limit instead of 256KiB

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

• Single-line constant value update with minimal blast radius
• Comment update is straightforward and clearly documents the new limit

Poem

🐰 A rabbit hops with glee,
As payloads grow, wild and free!
From 256 to 1024 grand,
CloudWatch logs now expand!
More data flows, hooray, hooray! 🎉

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: increasing MAX_EVENT_LEN to match current CloudWatch Logs maximum event size.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f1ba23a and 7c85150.

📒 Files selected for processing (1)

• plugins/out_cloudwatch_logs/cloudwatch_api.h (1 hunks)

🔇 Additional comments (1)

plugins/out_cloudwatch_logs/cloudwatch_api.h (1)

46-47: Change verified: mathematical correctness confirmed and AWS documentation supports 1 MB limit.

The calculation is correct: 1 MiB (1,048,576 bytes) minus 26 bytes equals 1,048,550. Amazon CloudWatch Logs maximum single log event size is 1 MB (introduced April 2, 2025), with a maximum batch size of 1,048,576 bytes (sum of UTF‑8 event messages + 26 bytes per event).

Usage of MAX_EVENT_LEN in the codebase is safe: it's used only for bounds checking and truncation (cloudwatch_api.c:558–561), preventing buffer overflows.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Allow payload buffer to accommodate 1 MiB events

Raising MAX_EVENT_LEN to 1 048 550 means event->len + PUT_LOG_EVENTS_PER_EVENT_LEN now evaluates to 1 048 592 bytes. However, PUT_LOG_EVENTS_PAYLOAD_SIZE remains 1 048 576, so put_log_events() immediately treats any max-size message as “larger than our entire request buffer” and discards it before sending. As written, 1 MiB events still cannot be emitted despite the new constant. The payload limit or per-event overhead needs to be adjusted in tandem so a single event can fit into the request buffer.

Useful? React with 👍 / 👎.

[ShelbyZ]

Working on the adjustment to the max size in a follow-up