Limit number of bytes read from a file

Is there an option which can limit the number of bytes to be read from a file ?
Some of the users are creating jobs that has very large log files and in that case i do not
want to index all data but limit to a specific total_bytes value for that file.

I have looked at the exclude_lines and include_lines option but users can get creative and abuse the system.


I may be able to achieve it with drop event processor (

- drop_event:
log.offset.gte: 1048550

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.