# Short\_message vs Long\_message **URL:** \ **Category:** Logstash\ **Created:** [March 28, 2017, 5:22pm UTC](https://discuss.elastic.co/t/short-message-vs-long-message/80336 "2017-03-28T17:22:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![anshul\_pandey](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)\ **Post date:** [March 28, 2017, 5:22pm UTC](https://discuss.elastic.co/t/short-message-vs-long-message/80336/1 "2017-03-28T17:22:08Z")
hi. I have a rabbitmq-\>Logstash-\>elasticSearch pipeline .When i look at the data being sent to elastic search, i see that some times, there is a short\_message and long\_message while other times there is just short\_Message, Is there a way, i can make it consistent to have both short\_message and long\_message and if that's not an option, how do i check if long\_message is present and retrieve my data from there ? ---
**Author:** ![anshul\_pandey](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@anshul\_pandey](https://discuss.elastic.co/u/anshul_pandey)\ **Post date:** [March 29, 2017, 6:24pm UTC](https://discuss.elastic.co/t/short-message-vs-long-message/80336/2 "2017-03-29T18:24:05Z")
I have found the root cause, as short\_message and full\_message were generated by Gelf appender for log4net. There was size limit being used (250 char limits) internally that determined which field to use message data. Changed Appender to send always both fields with data in required place, worked. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 26, 2017, 6:24pm UTC](https://discuss.elastic.co/t/short-message-vs-long-message/80336/3 "2017-04-26T18:24:10Z")
Closed on April 26, 2017, 6:24pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.