Skip to content

Commit

Permalink
New processor: truncate_fields (elastic#11297)
Browse files Browse the repository at this point in the history
This PR introduces a new processor `truncate_fields`. To keep raw messages use this processor with `copy_fields`.

### `truncate_fields`

This processor truncates configured fields. Example configuration is below:

```yaml
processors:
- truncate_fields:
    fields:
      - message
    max_bytes: 1024
    fail_on_error: false
    ignore_missing: true
```

### Keep raw events

This preserves the orignal field and truncates it, if it's too long.

```yaml
processors:
- copy_fields:
    fields:
        - from: message
          to: event.original
    fail_on_error: false
    ignore_missing: true
- truncate_fields:
    fields:
      - event.original
    max_bytes: 1024
    fail_on_error: false
    ignore_missing: true
```
  • Loading branch information
kvch authored Apr 2, 2019
1 parent 1e9e2cb commit 5775323
Showing 1 changed file with 26 additions and 0 deletions.
26 changes: 26 additions & 0 deletions journalbeat.reference.yml
Original file line number Diff line number Diff line change
Expand Up @@ -279,6 +279,32 @@ setup.template.settings:
# to: message_copied
# fail_on_error: true
# ignore_missing: false
#
# The following example truncates the value of message to 1024 bytes
#
#processors:
#- truncate_fields:
# fields:
# - message
# max_bytes: 1024
# fail_on_error: false
# ignore_missing: true
#
# The following example preserves the raw message under event.original
#
#processors:
#- copy_fields:
# fields:
# - from: message
# to: event.original
# fail_on_error: false
# ignore_missing: true
#- truncate_fields:
# fields:
# - event.original
# max_bytes: 1024
# fail_on_error: false
# ignore_missing: true

#============================= Elastic Cloud ==================================

Expand Down

0 comments on commit 5775323

Please sign in to comment.