If the length of the message above is greater than 1116, it will be lost after formatting! When using filebeat decode_json_fields to parse json object, if the field content of json key is too long, it will be discarded directly. Which attribute should be set?
Message field is a string type. No matter any character entered, if it exceeds a certain length, it will be lost after formatted and stored in es.
The following is the content of my profile
filebeat.inputs:
- type: log
enabled: true
paths:
- /opt/site/TestAPI/collectlog/current.log
multiline.pattern: ^{ "time"
multiline.negate: true
multiline.match: after
fields_under_root: true
fields: {server: "VMTest" }
# ======================= Elasticsearch template setting =======================
setup.template.settings:
index.number_of_shards: 1
index.number_of_replicas: 0
setup.template.type: index
setup.template.enabled: true
setup.template.overwrite: true
setup.template.fields: "yy_server_log_fields.yml"
setup.template.name: "yy_server_log_index_template"
setup.template.pattern: "yy_server_log*"
setup.ilm.enabled: false
output.elasticsearch:
hosts: ["localhost:9200"]
index: "yy_server_log_%{+yyyy.MM.dd}"
#protocol: "https"
#api_key: "id:api_key"
username: "elastic"
password: "some_password"
# ================================= Processors =================================
processors:
- decode_json_fields:
fields: ["message"]
process_array: false
max_depth: 1
target: "yylog"
overwrite_keys: false
add_error_key: true
- drop_fields:
fields: ["log","host","input","ecs","agent"]
ignore_missing: true