Skip to main content

Maximum character in log message

  • March 4, 2024
  • 1 reply
  • 26 views

Forum|alt.badge.img+5

Hi Team,

We are using Wazuh agent in some of our endpoint and using Chronicle forwarder to ingest those logs in to the Chronicle instance. Everything is working fine, however, we are noticing those logs are truncated at 8194 character (there are few that reach the limit). This is causing the parsers to fail - as the overall log is now not a JSON body. How can we increase the character limit.

1 reply

Forum|alt.badge.img+4
  • Bronze 1
  • April 4, 2024

Are you certain Wazuh isn't truncating the messages? Try running tcp dump on the forwarder box to see if the messages are being truncated.