• EnglishEspañol日本語한국어Português
  • Log inStart now

Log message is truncated

Problem

Not all log data in a message or for a specific attribute is being displayed. The log data ends with an ellipsis (...) and the remaining data isn't shown.

Solution

This occurs because the logs datastore in New Relic limits the field length to 4,094 characters. Any data longer than that is truncated during ingestion.

If you have values exceeding the character limit, here are some options to try:

Troubleshooting tips

Comments

Parse long messages

Parse your log message into shorter key/value pairs. A common example is a single log line from an NGINX access log. That log message can be parsed using built-in parsing via Logstash, Fluentd, or Fluent Bit. For more information, see our documentation about parsing log data.

Use JSON output

Use JSON as an output format instead of plain text. JSON log messages will automatically be parsed into key/value pairs, which makes it much less likely to hit the character limit.

Expand blob data

The first 4,094 characters in a log message are stored as a string. The next 128,000 bytes are stored as a blob.

To query for logs that have likely exceeded this storage limit in New Relic, run the following query:

SELECT * FROM Log WHERE length(message) >= 4094

To expand the blob data, run the following query, using message or any other attribute. Be sure to enclose the blob's attribute with backticks. For example:

SELECT message, another-attribute, blob(`newrelic.ext.message`), blob(`newrelic.ext.another-attribute`)
FROM Log

For more information, see our documentation about long messages stored as blobs.

Copyright © 2024 New Relic Inc.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.