Remove some parts in the middle of a string

Elastic Stack Logstash
1

Hi,

we have the problems, that some errors (stackTraces) get really long.
In such cases, we get the error

Document contains at least one immense term in field=\"exception.stackTrace\" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms

We are not willing to not-analyse the filed because it is quite important. But what can be said is, that usual the middle part is not very interesting. Just the beginning and the end.

So it would be great if I can say: First 15.000 bytes + "..." + the last 15.000 bytes.
So just shorten the stackTrace in the uninteresting middle.

Is this somehow possible?

2

You might be able to use a mutate filter's gsub option, but you can definitely use a ruby filter to do this.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.