JMS Modular Input - Truncation of events greater than 10,000 chars

[rturk]

Greetings!

We have configured the JMS Modular Input to be a durable subscriber to a JMS queue and we're happily retrieving data :thumbs-up:

We are also doing this in a DEV/TEST environment. In this environment, (large) stack traces are sometimes in the JSON payloads which tips the event over 10,000 characters... at which point we see the event become truncated, which breaks the JSON structure and the use of spath :sad-face:

Is there any setting anywhere that would allow me to disable/negate this?

Regards,

RT.

[Damien_Dallimor · Accepted solution]

You can set the TRUNCATE parameter in props.conf for your sourcetype to prevent truncation.

As described in this answer.

[rturk]

Thanks Damien - I think I was having a derr moment as I put the TRUNCATE statement in the inputs.conf... Mea culpa. Thanks again for your help.