New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Translate SID URL Decode »
Elastic Docs ›Fleet and Elastic Agent Guide [8.8] ›Define processors

Truncate fields

edit

Truncate fields

edit

The truncate_fields processor truncates a field to a given size. If the size of the field is smaller than the limit, the field is left as is.

Example

edit

This configuration truncates the field named message to five characters:

  - truncate_fields:
      fields:
        - message
      max_characters: 5
      fail_on_error: false
      ignore_missing: true

Configuration settings

edit

Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?

Name Required Default Description

fields

Yes

List of fields to truncate. You can use the @metadata. prefix to truncate values in the event metadata instead of event fields.

max_bytes

Yes

Maximum number of bytes in a field. Mutually exclusive with max_characters.

max_characters

Yes

Maximum number of characters in a field. Mutually exclusive with max_bytes.

fail_on_error

No

true

If true and an error occurs, any changes to the event are reverted, and the original event is returned. If false, processing continues even if an error occurs.

ignore_missing

No

false

Whether to ignore events that lack the source field. If false, processing of the event fails if a field is missing.
« Translate SID URL Decode »

On this page

Was this helpful?
Feedback