Filter out Large Messages and Add Tag

Hi,
We have problems caused by very large log messages. Can someone help me with how to formulate the following filter logic:

  1. Drop the message field when it is over "n" bytes
  2. Add a tag showing that the message field has been filtered

Logstash version is 2.3.4

Regards,
David

Probably works:

filter {
  ruby {
    code => "
      if event['message'].length > n
        event.remove('message')
        event.tag('too_big')
      end
    "
  }
}

Rreplace n with whatever size limit you want.

Hi,
Thanks for that. I worked around this by using the range plugin but will test this out asap...

Regards,
David