Log message is truncated

Problem

Not all log data in a message or for a specific attribute is being displayed. The log data ends with an ellipses (...) and the remaining data isn't shown.

Solution

This occurs because the New Relic Logs datastore limits field length to 4096 characters. Any data longer than that is truncated during ingestion.

If you have values exceeding the character limit, here are some options to explore:

  • Parse your log message into shorter key-value pairs. A common example is a single log line from an NGINX access log. That log message can be parsed using built-in parsing via Logstash, Fluentd, or Fluentbit.
  • Use JSON as an output format instead of plain text. JSON log messages will automatically be parsed into key/value pairs, which makes it much less likely to hit the character limit.
  • Split a long section of text across multiple fields, instead of it all being a part of the message field. For information on how to do this, contact your New Relic account representative or support.

For more help

Recommendations for learning more: