# I want to import a 3GB system file to ELK in one go

**URL:** <https://discuss.elastic.co/t/i-want-to-import-a-3gb-system-file-to-elk-in-one-go/240572>\
**Category:** Elasticsearch\
**Created:** [July 9, 2020, 4:53pm UTC](https://discuss.elastic.co/t/i-want-to-import-a-3gb-system-file-to-elk-in-one-go/240572 "2020-07-09T16:53:45Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 13, 2020, 8:00am UTC](https://discuss.elastic.co/t/i-want-to-import-a-3gb-system-file-to-elk-in-one-go/240572/21 "2020-07-13T08:00:13Z")

</div>

Even if you do not store them you need to parse them as the are not in KV format.

---

<div class="post-metadata">

**Author:** ![Deepika\_Rawat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepika_rawat/32/71899_2.png) [@Deepika\_Rawat](https://discuss.elastic.co/u/Deepika_Rawat)\
**Post date:** [July 13, 2020, 9:08am UTC](https://discuss.elastic.co/t/i-want-to-import-a-3gb-system-file-to-elk-in-one-go/240572/22 "2020-07-13T09:08:52Z")

</div>

I tried to import using kv filter  
my logs started importing like this..  
indent preformatted text by 4 spaces  
"authserver" =\> "a\_India RADIUS",  
"proto" =\> "6",  
"devname" =\> "FW\_1",  
"10:56:12\tdate" =\> "2020-06-22\tlocal7\tnotice\t\ttime=10:56:11",  
"host" =\> "kali",  
"dstintf" =\> "wan1",  
"path" =\> "/root/Cybrotech-/log00",  
"subtype" =\> "webfilter",  
"srcintf" =\> "ssl.root",  
"method" =\> "domain",  
"eventtype" =\> "ftgd\_allow",  
"hostname" =\> "[webmail.accessarellc.net](http://webmail.accessarellc.net)",  
"cat" =\> "33",  
"srcintfrole" =\> "undefined",  
"dstip" =\> "20.73.98.154",  
"type" =\> "utm",  
"sessionid" =\> "677535",  
"dstintfrole" =\> "wan",  
"srcport" =\> "6095",  
"url" =\> "/",  
"profile" =\> "monitor-all",  
"srcip" =\> "10.212.134.190",  
"logid" =\> "07013312",  
"policyid" =\> "17",  
"eventtime" =\> "12803571",  
"direction" =\> "outgoing",  
"level" =\> "notice",  
"@version" =\> "1",  
"reqtype" =\> "direct",  
"catdesc" =\> ""Health",  
"action" =\> "passthrough",  
"vd" =\> "root",  
"dstport" =\> "443",  
"service" =\> "HTTPS",  
"@timestamp" =\> 2020-07-13T09:10:47.811Z,  
"sentbyte" =\> "192",  
"devid" =\> "FG0TK19907000",  
"group" =\> "SSLVPN\_Group",  
"msg" =\> "URL belongs to an allowed category in policy",  
"user" =\> "\ASINGH",  
"rcvdbyte" =\> "0"  
}  
after some time i got this error on screen

```
indent preformatted text by 4 spaces

```

"\_type"=\>"doc", "\_id"=\>"LzhxR3MBoH6QvDEw21Sy", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Limit of total fields [1000] in index [log00\_210270] has been exceeded"}}}}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2020, 9:09am UTC](https://discuss.elastic.co/t/i-want-to-import-a-3gb-system-file-to-elk-in-one-go/240572/23 "2020-08-10T09:09:07Z")

</div>

Closed on August 10, 2020, 9:09am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/i-want-to-import-a-3gb-system-file-to-elk-in-one-go/240572.md?page=1)