Truncate fields

The truncate_fields processor truncates a field to a given size. If the size of the field is smaller than the limit, the field is left as is.

Example

This configuration truncates the field named message to five characters:

- truncate_fields:
    fields:
      - message
    max_characters: 5
    fail_on_error: false
    ignore_missing: true

Configuration settings

Note

Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?

Name	Required	Default	Description
`fields`	Yes		List of fields to truncate. You can use the `@metadata.` prefix to truncate values in the event metadata instead of event fields.
`max_bytes`	Yes		Maximum number of bytes in a field. Mutually exclusive with `max_characters`.
`max_characters`	Yes		Maximum number of characters in a field. Mutually exclusive with `max_bytes`.
`fail_on_error`	No	`true`	If `true` and an error occurs, any changes to the event are reverted, and the original event is returned. If `false`, processing continues even if an error occurs.
`ignore_missing`	No	`false`	Whether to ignore events that lack the source field. If `false`, processing of the event fails if a field is missing.