Skip to content

Instantly share code, notes, and snippets.

Last active January 18, 2023 01:10
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
Logstash ruby filter to truncate messages that are too long to make it to elasticsearch
filter {
ruby {
code => "event.set('message_size', event.get('message').bytesize) if event.get('message')"
ruby {
code => "
if (event.get('message_size'))
event.set('message', event.get('message')[0..9999]) if event.get('message_size') > 32000
event.tag 'long message' if event.get('message_size') > 32000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment