Json.keys_under_root ignored for JSON documents larger than 4096 bytes

Elastic Stack Elastic Agent
1

Hi, we seem to be hitting a hard limit on our Custom Logs integration for the Elastic Agent, ingesting json logs.

We have the following custom configuration:

json:
  keys_under_root: true

This works fine for all json log lines until the line length reaches 4096 characters. After that the the entire log line is truncated to 4096 bytes and then added to the message field. Anybody know where to configure this hard limit?

I've searched around but are not able to find any obvious solutions. I found this post, and it seems to be a very similar issue but with no solutions (ours are single-line json documents).

Any help would be greatly appreciated!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.