Truncate fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
The truncate_fields processor truncates a field to a given size. If the size of the field is smaller than the limit, the field is left as is.
fields- List of fields to truncate. It’s supported to use
@metadata.prefix for the fields and truncate values in the event metadata instead of event fields. max_bytes- Maximum number of bytes in a field. Mutually exclusive with
max_characters. max_characters- Maximum number of characters in a field. Mutually exclusive with
max_bytes. fail_on_error- (Optional) If set to true, in case of an error the changes to the event are reverted, and the original event is returned. If set to
false, processing continues also if an error happens. Default istrue. ignore_missing- (Optional) Whether to ignore events that lack the source field. The default is
false, which will fail processing of an event if a field is missing.
For example, this configuration truncates the field named message to 5 characters:
processors:
- truncate_fields:
fields:
- message
max_characters: 5
fail_on_error: false
ignore_missing: true