Truncate fields
editTruncate fields
editThe truncate_fields
processor truncates a field to a given size. If the size
of the field is smaller than the limit, the field is left as is.
Example
editThis configuration truncates the field named message
to five characters:
- truncate_fields: fields: - message max_characters: 5 fail_on_error: false ignore_missing: true
Configuration settings
editElastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?
Name | Required | Default | Description |
---|---|---|---|
|
Yes |
List of fields to truncate. You can use the |
|
|
Yes |
Maximum number of bytes in a field. Mutually exclusive with |
|
|
Yes |
Maximum number of characters in a field. Mutually exclusive with |
|
|
No |
|
If |
|
No |
|
Whether to ignore events that lack the source field. If |