Hello All,
I have faced interesting issue. I have an ingest time extraction.
[extract]
REGEX = ^([^\r\n]+)$
FORMAT = message::$1
DEST_KEY = _raw
Truncation not the case, I set it to zero and the whole event is not longer than 5000 characters BUT the message field is truncated exactly after 4023 characters.
Where it is written that an extracted field cannot be longer than this amount of characters.
Thanks.
