# Matched field truncated by grok
**URL:** https://discuss.elastic.co/t/matched-field-truncated-by-grok/66526
**Category:** Logstash
**Created:** [November 18, 2016, 11:22am UTC](https://discuss.elastic.co/t/matched-field-truncated-by-grok/66526 "2016-11-18T11:22:31Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@arussel](https://discuss.elastic.co/u/arussel)
#### Post date: [November 18, 2016, 11:22am UTC](https://discuss.elastic.co/t/matched-field-truncated-by-grok/66526/1 "2016-11-18T11:22:31Z")
I do:
> grok { match =\> { "message" =\> "%{GREEDYDATA:foo}" } }
and I would expect that message and foo are the same, but foo is only the first ~4000 chars of message. I don't believe this is an event size issue, as I'm testing it with stdin/sdtout, and message is correctly shown as about 6000 chars. But foo has only the first 4000.
Alex
---
### Author:  [@arussel](https://discuss.elastic.co/u/arussel)
#### Post date: [November 18, 2016, 1:04pm UTC](https://discuss.elastic.co/t/matched-field-truncated-by-grok/66526/2 "2016-11-18T13:04:01Z")
I've manage to find the root cause, I was testing using stdin/stdout, cut/pasting my data into the command line. It seems that my cut/paste buffer was 4096 chars. When echo/cat the input, it works as expected.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 16, 2016, 1:04pm UTC](https://discuss.elastic.co/t/matched-field-truncated-by-grok/66526/3 "2016-12-16T13:04:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.