logstash-output-scalyr 0.1.20.beta → 0.1.24.beta

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23ede2e07ed42483146d4a267c8517fed2f8639fb27998e3f37e8732bd50a45d
-  data.tar.gz: 4d3594dd94a908d5852d58fc6e5214982ae731ef8b3de3eb3707455bfa77bd3d
+  metadata.gz: 312d501ddc98f27b8d2be32bb20cb29439e7ce096d5f12870ef1b1bf095c32ee
+  data.tar.gz: c0f6c4a51f42acef8266ee30480fc00a19e59098d7b957deddcc017bade71695
 SHA512:
-  metadata.gz: b11f8aaeea8530b316de904d2fd4b654b8b2a33c2c13ca10614ca3cb346a154e494d9ec7c831a1cf0a83449101ed2bb59c97cc5506870bd252c31cbf9dbc9052
-  data.tar.gz: dc6a23b5eae108b7ac8818cfd018c9a9670f69c31fb582b7c8568ebb33720fef19564b54420b2cfc4e7fc04e4a742836bdd2eefc013b15e240379726858fe15f
+  metadata.gz: 2628a0bcfbe9a13dfc5bb9fd93360ef7629fca158cc325184817b4f15492ff5fcb28c03ca992c08dbbf9dc7953d2715b071b5d94f67912c36f66625f7bcf3234
+  data.tar.gz: 1d009fe06794e8f2d15737da874609600e57569fe3d6be0297fb23a1ab99d375f3ac2e9bdbf52b653baa85222bc3d5da001ac8d68a3848c8099ed7eb1510175f

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Beta
 
+## 0.1.23.beta
+- Add testing support for disabling estimation of serialized event size for each event in the batch.
+
+## 0.1.22.beta
+- Add new plugin metric for tracking the duration of ``build_multi_event_request_array`` method.
+- Update internal dependencies (``manticore``) to latest stable version.
+
+## 0.1.21.beta
+- Fix issue with iterative flattening function when dealing with empty collections.
+
 ## 0.1.20.beta
 - Rewrite flattening function to no longer be recursive, to help avoid maxing out the stack.
 - Added a configurable value `flattening_max_key_count` to create a limit on how large of a record we can flatten.

data/Gemfile

@@ -16,5 +16,5 @@ end
 
 gem 'pry'
 gem 'pry-nav'
-gem 'quantile'
-gem 'manticore', platform: :jruby
+gem 'quantile', '~> 0.2.1'
+gem 'manticore', '~> 0.7.1', platform: :jruby

data/README.md

@@ -10,7 +10,7 @@ You can view documentation for this plugin [on the Scalyr website](https://app.s
 # Quick start
 
 1. Build the gem, run `gem build logstash-output-scalyr.gemspec` 
-2. Install the gem into a Logstash installation, run `/usr/share/logstash/bin/logstash-plugin install logstash-output-scalyr-0.1.20.beta.gem` or follow the latest official instructions on working with plugins from Logstash.
+2. Install the gem into a Logstash installation, run `/usr/share/logstash/bin/logstash-plugin install logstash-output-scalyr-0.1.22.beta.gem` or follow the latest official instructions on working with plugins from Logstash.
 3. Configure the output plugin (e.g. add it to a pipeline .conf)
 4. Restart Logstash 
 
@@ -321,6 +321,12 @@ If you want to run just the unit tests, you can run the command displayed below.
 bundle exec rspec spec/logstash/outputs/scalyr_spec.rb spec/scalyr/common/util_spec.rb
 ```
 
+Or to run a single test function defined on line XXX
+
+```bash
+bundle exec rspec spec/scalyr/common/util_spec.rb:XXX
+```
+
 ## Instrumentation and metrics
 
 By default, plugin logs a special line with metrics to Scalyr every 5 minutes. This line contains

data/lib/logstash/outputs/scalyr.rb

@@ -140,11 +140,17 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
   # Whether or not to create fresh quantile estimators after a status send. Depending on what you want to gather from
   # these stas this might be wanted or not.
   config :flush_quantile_estimates_on_status_send, :validate => :boolean, :default => false
-  
+
   # Causes this plugin to act as if it successfully uploaded the logs, while actually returning as quickly as possible
   # after no work being done.
   config :noop_mode, :validate => :boolean, :default => false
 
+  # Set to true to disable estimiating the size of each serialized event to make sure we don't go over the max request
+  # size (5.5) and split batch into multiple Scalyr requests, if needed. Since this estimation is not "free", especially
+  # for large batches, it may make sense to disable this option when logstash batch size is configured in a way that
+  # Scalyr single request limit won't be reached.
+  config :estimate_each_event_size, :validate => :boolean, :default => true
+
   # Manticore related options
   config :http_connect_timeout, :validate => :number, :default => 10
   config :http_socket_timeout, :validate => :number, :default => 10
@@ -289,6 +295,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
   # Convenience method to create a fresh quantile estimator
   def get_new_metrics
     return {
+      :build_multi_duration_secs => Quantile::Estimator.new,
       :multi_receive_duration_secs => Quantile::Estimator.new,
       :multi_receive_event_count => Quantile::Estimator.new,
       :event_attributes_count => Quantile::Estimator.new,
@@ -313,17 +320,21 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
     return events if @noop_mode
 
     begin
+      records_count = events.to_a.length
+
+      # We also time the duration of the build_multi_event_request_array method. To avoid locking twice,
+      # we store the duration value here and record metric at the end.
       start_time = Time.now.to_f
 
       multi_event_request_array = build_multi_event_request_array(events)
-      # Loop over all array of multi-event requests, sending each multi-event to Scalyr
+      build_multi_duration_secs = Time.now.to_f - start_time
 
+      # Loop over all array of multi-event requests, sending each multi-event to Scalyr
       sleep_interval = @retry_initial_interval
       batch_num = 1
       total_batches = multi_event_request_array.length unless multi_event_request_array.nil?
 
       result = []
-      records_count = events.to_a.length
 
       while !multi_event_request_array.to_a.empty?
         multi_event_request = multi_event_request_array.pop
@@ -430,6 +441,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
       if records_count > 0
         @stats_lock.synchronize do
           @multi_receive_statistics[:total_multi_receive_secs] += (Time.now.to_f - start_time)
+          @plugin_metrics[:build_multi_duration_secs].observe(build_multi_duration_secs)
           @plugin_metrics[:multi_receive_duration_secs].observe(Time.now.to_f - start_time)
           @plugin_metrics[:multi_receive_event_count].observe(records_count)
           @plugin_metrics[:batches_per_multi_receive].observe(total_batches)
@@ -666,67 +678,75 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
         scalyr_event[:log] = logs_ids[log_identifier]
       end
 
-      # get json string of event to keep track of how many bytes we are sending
-      begin
-        event_json = scalyr_event.to_json
-        log_json = nil
-        if add_log
-          log_json = logs[log_identifier].to_json
-        end
-      rescue JSON::GeneratorError, Encoding::UndefinedConversionError => e
-        @logger.warn "#{e.class}: #{e.message}"
-
-        # Send the faulty event to a label @ERROR block and allow to handle it there (output to exceptions file for ex)
-        # TODO
-        # atime = Fluent::EventTime.new( sec, nsec )
-        # router.emit_error_event(serverHost, time, record, e)
-
-        scalyr_event[:attrs].each do |key, value|
-          @logger.debug "\t#{key} (#{value.encoding.name}): '#{value}'"
-          scalyr_event[:attrs][key] = value.encode(
-              "UTF-8", :invalid => :replace, :undef => :replace, :replace => "<?>"
-          ).force_encoding('UTF-8')
-        end
-        event_json = scalyr_event.to_json
-      rescue Java::JavaLang::ClassCastException => e
-        # Most likely we ran into the issue described here: https://github.com/flori/json/issues/336
-        # Because of the version of jruby logstash works with we don't have the option to just update this away,
-        # so if we run into it we convert bignums into strings so we can get the data in at least.
-        # This is fixed in JRuby 9.2.7, which includes json 2.2.0
-        @logger.warn("Error serializing events to JSON, likely due to the presence of Bignum values. Converting Bignum values to strings.")
-        @stats_lock.synchronize do
-          @multi_receive_statistics[:total_java_class_cast_errors] += 1
+      if @estimate_each_event_size
+        # get json string of event to keep track of how many bytes we are sending
+        begin
+          event_json = scalyr_event.to_json
+          log_json = nil
+          if add_log
+            log_json = logs[log_identifier].to_json
+          end
+        rescue JSON::GeneratorError, Encoding::UndefinedConversionError => e
+          @logger.warn "#{e.class}: #{e.message}"
+
+          # Send the faulty event to a label @ERROR block and allow to handle it there (output to exceptions file for ex)
+          # TODO
+          # atime = Fluent::EventTime.new( sec, nsec )
+          # router.emit_error_event(serverHost, time, record, e)
+
+          scalyr_event[:attrs].each do |key, value|
+            @logger.debug "\t#{key} (#{value.encoding.name}): '#{value}'"
+            scalyr_event[:attrs][key] = value.encode(
+                "UTF-8", :invalid => :replace, :undef => :replace, :replace => "<?>"
+            ).force_encoding('UTF-8')
+          end
+          event_json = scalyr_event.to_json
+        rescue Java::JavaLang::ClassCastException => e
+          # Most likely we ran into the issue described here: https://github.com/flori/json/issues/336
+          # Because of the version of jruby logstash works with we don't have the option to just update this away,
+          # so if we run into it we convert bignums into strings so we can get the data in at least.
+          # This is fixed in JRuby 9.2.7, which includes json 2.2.0
+          @logger.warn("Error serializing events to JSON, likely due to the presence of Bignum values. Converting Bignum values to strings.")
+          @stats_lock.synchronize do
+            @multi_receive_statistics[:total_java_class_cast_errors] += 1
+          end
+          Scalyr::Common::Util.convert_bignums(scalyr_event)
+          event_json = scalyr_event.to_json
+          log_json = nil
+          if add_log
+            log_json = logs[log_identifier].to_json
+          end
         end
-        Scalyr::Common::Util.convert_bignums(scalyr_event)
-        event_json = scalyr_event.to_json
-        log_json = nil
-        if add_log
-          log_json = logs[log_identifier].to_json
+
+        # generate new request if json size of events in the array exceed maximum request buffer size
+        append_event = true
+        add_bytes = event_json.bytesize
+        if log_json
+          add_bytes = add_bytes + log_json.bytesize
         end
-      end
 
-      # generate new request if json size of events in the array exceed maximum request buffer size
-      append_event = true
-      add_bytes =  event_json.bytesize
-      if log_json
-        add_bytes = add_bytes + log_json.bytesize
-      end
-      if total_bytes + add_bytes > @max_request_buffer
-        # make sure we always have at least one event
-        if scalyr_events.size == 0
-          scalyr_events << scalyr_event
-          l_events << l_event
-          append_event = false
+        if total_bytes + add_bytes > @max_request_buffer
+          # make sure we always have at least one event
+          if scalyr_events.size == 0
+            scalyr_events << scalyr_event
+            l_events << l_event
+            append_event = false
+          end
+
+          multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs)
+          multi_event_request_array << multi_event_request
+
+          total_bytes = 0
+          current_threads = Hash.new
+          logs = Hash.new
+          logs_ids = Hash.new
+          scalyr_events = Array.new
+          l_events = Array.new
         end
-        multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs)
-        multi_event_request_array << multi_event_request
-
-        total_bytes = 0
-        current_threads = Hash.new
-        logs = Hash.new
-        logs_ids = Hash.new
-        scalyr_events = Array.new
-        l_events = Array.new
+      else
+        # If size estimation is disabled we simply append the event and handle splitting later on (if needed)
+        append_event = true
+        add_bytes = 0
       end
 
       # if we haven't consumed the current event already
@@ -739,9 +759,12 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
 
     }
 
-    # create a final request with any left over events
-    multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs)
-    multi_event_request_array << multi_event_request
+    # create a final request with any left over events (and make sure there is at least one event)
+    if scalyr_events.size >= 1
+      multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs)
+      multi_event_request_array << multi_event_request
+    end
+
     multi_event_request_array
   end
 
@@ -803,6 +826,14 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
     end
     end_time = Time.now.to_f
     serialization_duration = end_time - start_time
+
+    serialized_request_size = serialized_body.bytesize
+
+    if serialized_request_size >= @max_request_buffer
+      # TODO: If we end up here is estimate config opsion is false, split the request here into multiple ones
+      @logger.warn("Serialized request size (#{serialized_request_size}) is larger than max_request_buffer (#{max_request_buffer})!")
+    end
+
     {
       :body => serialized_body, :record_count => scalyr_events.size, :serialization_duration => serialization_duration,
       :logstash_events => logstash_events
@@ -816,6 +847,10 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
     @stats_lock.synchronize do
       current_stats = @multi_receive_statistics.clone
 
+      current_stats[:build_multi_duration_secs_p50] = @plugin_metrics[:build_multi_duration_secs].query(0.5)
+      current_stats[:build_multi_duration_secs_p90] = @plugin_metrics[:build_multi_duration_secs].query(0.9)
+      current_stats[:build_multi_duration_secs_p99] = @plugin_metrics[:build_multi_duration_secs].query(0.99)
+
       current_stats[:multi_receive_duration_p50] = @plugin_metrics[:multi_receive_duration_secs].query(0.5)
       current_stats[:multi_receive_duration_p90] = @plugin_metrics[:multi_receive_duration_secs].query(0.9)
       current_stats[:multi_receive_duration_p99] = @plugin_metrics[:multi_receive_duration_secs].query(0.99)

data/lib/scalyr/common/util.rb

@@ -42,7 +42,7 @@ def self.flatten(hash_obj, delimiter='_', flatten_arrays=true, fix_deep_flatteni
     key_list << key_stack.pop
 
     # Case when object is a hash
-    if obj.respond_to?(:has_key?)
+    if obj.respond_to?(:has_key?) and obj.keys.count > 0
       key_list_width << obj.keys.count
       obj.each do |key, value|
         key_stack << key
@@ -50,12 +50,12 @@ def self.flatten(hash_obj, delimiter='_', flatten_arrays=true, fix_deep_flatteni
       end
 
     # Case when object is an array we intend to flatten
-    elsif flatten_arrays and obj.respond_to?(:each)
-      key_list_width << obj.count
-      obj.each_with_index do |value, index|
-        key_stack << index
-        stack << value
-      end
+    elsif flatten_arrays and obj.respond_to?(:each) and obj.count > 0
+        key_list_width << obj.count
+        obj.each_with_index do |value, index|
+          key_stack << index
+          stack << value
+        end
 
     else
       result_key = ""

data/lib/scalyr/constants.rb

@@ -1,2 +1,2 @@
 # encoding: utf-8
-PLUGIN_VERSION = "v0.1.20.beta"
+PLUGIN_VERSION = "v0.1.24.beta"

data/logstash-output-scalyr.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = 'logstash-output-scalyr'
-  s.version         = '0.1.20.beta'
+  s.version         = '0.1.24.beta'
   s.licenses = ['Apache-2.0']
   s.summary = "Scalyr output plugin for Logstash"
   s.description     = "Sends log data collected by Logstash to Scalyr (https://www.scalyr.com)"

data/spec/logstash/outputs/scalyr_integration_spec.rb

@@ -7,6 +7,12 @@ require "json"
 require 'webmock/rspec'
 WebMock.allow_net_connect!
 
+RSpec.configure do |rspec|
+  rspec.expect_with :rspec do |c|
+    c.max_formatted_output_length = nil
+  end
+end
+
 describe LogStash::Outputs::Scalyr do
   let(:sample_events) {
     events = []
@@ -58,7 +64,7 @@ describe LogStash::Outputs::Scalyr do
                 {
                   :error_class=>"Manticore::UnknownException",
                   :batch_num=>1,
-                  :message=>"Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty",
+                  :message=>"java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty",
                   :payload_size=>781,
                   :record_count=>3,
                   :total_batches=>1,
@@ -84,7 +90,7 @@ describe LogStash::Outputs::Scalyr do
                 {
                   :error_class=>"Manticore::UnknownException",
                   :batch_num=>1,
-                  :message=>"Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty",
+                  :message=>"java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty",
                   :payload_size=>781,
                   :record_count=>3,
                   :total_batches=>1,

data/spec/logstash/outputs/scalyr_spec.rb

@@ -80,6 +80,7 @@ describe LogStash::Outputs::Scalyr do
         plugin1.instance_variable_set(:@client_session, mock_client_session)
         plugin1.instance_variable_set(:@session_id, "some_session_id")
         plugin1.instance_variable_set(:@plugin_metrics, {
+          :build_multi_duration_secs => Quantile::Estimator.new,
           :multi_receive_duration_secs => Quantile::Estimator.new,
           :multi_receive_event_count => Quantile::Estimator.new,
           :event_attributes_count =>  Quantile::Estimator.new,
@@ -87,10 +88,11 @@ describe LogStash::Outputs::Scalyr do
           :batches_per_multi_receive => Quantile::Estimator.new
         })
         plugin1.instance_variable_get(:@plugin_metrics)[:multi_receive_duration_secs].observe(1)
+        plugin1.instance_variable_get(:@plugin_metrics)[:build_multi_duration_secs].observe(1)
         plugin1.instance_variable_set(:@multi_receive_statistics, {:total_multi_receive_secs => 0})
 
         status_event = plugin1.send_status
-        expect(status_event[:attrs]["message"]).to eq("plugin_status: total_requests_sent=20 total_requests_failed=10 total_request_bytes_sent=100 total_compressed_request_bytes_sent=50 total_response_bytes_received=100 total_request_latency_secs=100 total_serialization_duration_secs=100.5000 total_compression_duration_secs=10.2000 compression_type=deflate compression_level=9 total_multi_receive_secs=0 multi_receive_duration_p50=1 multi_receive_duration_p90=1 multi_receive_duration_p99=1 multi_receive_event_count_p50=0 multi_receive_event_count_p90=0 multi_receive_event_count_p99=0 event_attributes_count_p50=0 event_attributes_count_p90=0 event_attributes_count_p99=0 batches_per_multi_receive_p50=0 batches_per_multi_receive_p90=0 batches_per_multi_receive_p99=0")
+        expect(status_event[:attrs]["message"]).to eq("plugin_status: total_requests_sent=20 total_requests_failed=10 total_request_bytes_sent=100 total_compressed_request_bytes_sent=50 total_response_bytes_received=100 total_request_latency_secs=100 total_serialization_duration_secs=100.5000 total_compression_duration_secs=10.2000 compression_type=deflate compression_level=9 total_multi_receive_secs=0 build_multi_duration_secs_p50=1 build_multi_duration_secs_p90=1 build_multi_duration_secs_p99=1 multi_receive_duration_p50=1 multi_receive_duration_p90=1 multi_receive_duration_p99=1 multi_receive_event_count_p50=0 multi_receive_event_count_p90=0 multi_receive_event_count_p99=0 event_attributes_count_p50=0 event_attributes_count_p90=0 event_attributes_count_p99=0 batches_per_multi_receive_p50=0 batches_per_multi_receive_p90=0 batches_per_multi_receive_p99=0")
       end
 
       it "returns and sends correct status event on send_stats on initial and subsequent send" do
@@ -106,6 +108,7 @@ describe LogStash::Outputs::Scalyr do
         plugin.instance_variable_set(:@client_session, mock_client_session)
         # Setup one quantile calculation to make sure at least one of them calculates as expected
         plugin.instance_variable_set(:@plugin_metrics, {
+          :build_multi_duration_secs => Quantile::Estimator.new,
           :multi_receive_duration_secs => Quantile::Estimator.new,
           :multi_receive_event_count => Quantile::Estimator.new,
           :event_attributes_count =>  Quantile::Estimator.new,
@@ -119,12 +122,13 @@ describe LogStash::Outputs::Scalyr do
 
         plugin.instance_variable_set(:@multi_receive_statistics, {:total_multi_receive_secs => 0})
         status_event = plugin.send_status
-        expect(status_event[:attrs]["message"]).to eq("plugin_status: total_requests_sent=20 total_requests_failed=10 total_request_bytes_sent=100 total_compressed_request_bytes_sent=50 total_response_bytes_received=100 total_request_latency_secs=100 total_serialization_duration_secs=100.5000 total_compression_duration_secs=10.2000 compression_type=deflate compression_level=9 total_multi_receive_secs=0 multi_receive_duration_p50=10 multi_receive_duration_p90=18 multi_receive_duration_p99=19 multi_receive_event_count_p50=0 multi_receive_event_count_p90=0 multi_receive_event_count_p99=0 event_attributes_count_p50=0 event_attributes_count_p90=0 event_attributes_count_p99=0 batches_per_multi_receive_p50=0 batches_per_multi_receive_p90=0 batches_per_multi_receive_p99=0 flatten_values_duration_secs_p50=0 flatten_values_duration_secs_p90=0 flatten_values_duration_secs_p99=0")
+        expect(status_event[:attrs]["message"]).to eq("plugin_status: total_requests_sent=20 total_requests_failed=10 total_request_bytes_sent=100 total_compressed_request_bytes_sent=50 total_response_bytes_received=100 total_request_latency_secs=100 total_serialization_duration_secs=100.5000 total_compression_duration_secs=10.2000 compression_type=deflate compression_level=9 total_multi_receive_secs=0 build_multi_duration_secs_p50=0 build_multi_duration_secs_p90=0 build_multi_duration_secs_p99=0 multi_receive_duration_p50=10 multi_receive_duration_p90=18 multi_receive_duration_p99=19 multi_receive_event_count_p50=0 multi_receive_event_count_p90=0 multi_receive_event_count_p99=0 event_attributes_count_p50=0 event_attributes_count_p90=0 event_attributes_count_p99=0 batches_per_multi_receive_p50=0 batches_per_multi_receive_p90=0 batches_per_multi_receive_p99=0 flatten_values_duration_secs_p50=0 flatten_values_duration_secs_p90=0 flatten_values_duration_secs_p99=0")
       end
 
       it "send_stats is called when events list is empty, but otherwise is noop" do
         quantile_estimator = Quantile::Estimator.new
         plugin.instance_variable_set(:@plugin_metrics, {
+          :build_multi_duration_secs => Quantile::Estimator.new,
           :multi_receive_duration_secs => Quantile::Estimator.new,
           :multi_receive_event_count => Quantile::Estimator.new,
           :event_attributes_count => Quantile::Estimator.new,
@@ -149,6 +153,7 @@ describe LogStash::Outputs::Scalyr do
         mock_client_session = MockClientSession.new
         quantile_estimator = Quantile::Estimator.new
         plugin2.instance_variable_set(:@plugin_metrics, {
+          :build_multi_duration_secs => Quantile::Estimator.new,
           :multi_receive_duration_secs => Quantile::Estimator.new,
           :multi_receive_event_count => Quantile::Estimator.new,
           :event_attributes_count => Quantile::Estimator.new,
@@ -174,6 +179,7 @@ describe LogStash::Outputs::Scalyr do
         plugin.instance_variable_set(:@last_status_transmit_time, 100)
         plugin.instance_variable_set(:@client_session, mock_client_session)
         plugin.instance_variable_set(:@plugin_metrics, {
+          :build_multi_duration_secs => Quantile::Estimator.new,
           :multi_receive_duration_secs => Quantile::Estimator.new,
           :multi_receive_event_count => Quantile::Estimator.new,
           :event_attributes_count =>  Quantile::Estimator.new,
@@ -386,6 +392,124 @@ describe LogStash::Outputs::Scalyr do
       end
     end
 
+    context "split large batches into multiple scalyr requests" do
+      it "estimate_each_event_size is true explicit (default) batch split into 3 scalyr requests" do
+        config = {
+            'api_write_token' => '1234',
+            'flatten_tags' => true,
+            'flat_tag_value' => 'true',
+            'flat_tag_prefix' => 'tag_prefix_',
+            'flatten_nested_values' => true,  # this converts into string 'true'
+            'max_request_buffer' => 10,
+            'estimate_each_event_size' => true
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+        result = plugin.build_multi_event_request_array(sample_events)
+        expect(result.size).to eq(3)
+
+        body = JSON.parse(result[0][:body])
+        expect(body['events'].size).to eq(1)
+
+        body = JSON.parse(result[1][:body])
+        expect(body['events'].size).to eq(1)
+
+        body = JSON.parse(result[2][:body])
+        expect(body['events'].size).to eq(1)
+        expect(body['events'][0]['attrs']).to eq({
+                                                     "nested_a" => 1,
+                                                     "nested_b_0" => 3,
+                                                     "nested_b_1" => 4,
+                                                     "nested_b_2" => 5,
+                                                     'seq' => 3,
+                                                     'source_file' => 'my file 3',
+                                                     'source_host' => 'my host 3',
+                                                     'serverHost' => 'Logstash',
+                                                     "tag_prefix_t1" => "true",
+                                                     "tag_prefix_t2" => "true",
+                                                     "tag_prefix_t3" => "true",
+                                                     "parser" => "logstashParser",
+                                                 })
+      end
+
+      it "estimate_each_event_size is true implicit (default) batch split into 3 scalyr requests" do
+        config = {
+            'api_write_token' => '1234',
+            'flatten_tags' => true,
+            'flat_tag_value' => 'true',
+            'flat_tag_prefix' => 'tag_prefix_',
+            'flatten_nested_values' => true,  # this converts into string 'true'
+            'max_request_buffer' => 10,
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+        result = plugin.build_multi_event_request_array(sample_events)
+        expect(result.size).to eq(3)
+
+        body = JSON.parse(result[0][:body])
+        expect(body['events'].size).to eq(1)
+
+        body = JSON.parse(result[1][:body])
+        expect(body['events'].size).to eq(1)
+
+        body = JSON.parse(result[2][:body])
+        expect(body['events'].size).to eq(1)
+        expect(body['events'][0]['attrs']).to eq({
+                                                     "nested_a" => 1,
+                                                     "nested_b_0" => 3,
+                                                     "nested_b_1" => 4,
+                                                     "nested_b_2" => 5,
+                                                     'seq' => 3,
+                                                     'source_file' => 'my file 3',
+                                                     'source_host' => 'my host 3',
+                                                     'serverHost' => 'Logstash',
+                                                     "tag_prefix_t1" => "true",
+                                                     "tag_prefix_t2" => "true",
+                                                     "tag_prefix_t3" => "true",
+                                                     "parser" => "logstashParser",
+                                                 })
+      end
+
+      it "estimate_each_event_size is false batch not split into multiple scalyr requests" do
+        config = {
+            'api_write_token' => '1234',
+            'flatten_tags' => true,
+            'flat_tag_value' => 'true',
+            'flat_tag_prefix' => 'tag_prefix_',
+            'flatten_nested_values' => true,  # this converts into string 'true'
+            'max_request_buffer' => 10,
+            'estimate_each_event_size' => false
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+        result = plugin.build_multi_event_request_array(sample_events)
+        expect(result.size).to eq(1)
+
+        body = JSON.parse(result[0][:body])
+        expect(body['events'].size).to eq(3)
+        expect(body['events'][2]['attrs']).to eq({
+                                                     "nested_a" => 1,
+                                                     "nested_b_0" => 3,
+                                                     "nested_b_1" => 4,
+                                                     "nested_b_2" => 5,
+                                                     'seq' => 3,
+                                                     'source_file' => 'my file 3',
+                                                     'source_host' => 'my host 3',
+                                                     'serverHost' => 'Logstash',
+                                                     "tag_prefix_t1" => "true",
+                                                     "tag_prefix_t2" => "true",
+                                                     "tag_prefix_t3" => "true",
+                                                     "parser" => "logstashParser",
+                                                 })
+      end
+    end
+
     context "when not configured to flatten values and tags" do
       config = {
           'api_write_token' => '1234',