Not all log data in a message or for a specific attribute is being displayed. The log data ends with an ellipses (
...) and the remaining data isn't shown.
This occurs because the logs datastore in New Relic limits the field length to 4,094 characters. Any data longer than that is truncated during ingestion.
If you have values exceeding the character limit, here are some options to try:
Parse long messages
Parse your log message into shorter key/value pairs. A common example is a single log line from an NGINX access log. That log message can be parsed using built-in parsing via Logstash, Fluentd, or Fluent Bit. For more information, see our documentation about parsing log data.
Use JSON output
Use JSON as an output format instead of plain text. JSON log messages will automatically be parsed into key/value pairs, which makes it much less likely to hit the character limit.
Expand blob data
The first 4,094 characters in a log message are stored as a string. The next 128,000 bytes are stored as a
To query for any log data in New Relic, run the following query:
To expand the blob data, run the following query, using
For more information, see our documentation about long messages stored as blobs.