Hi everybody
Trying to index a multivalue field with more than 6000 characters approx. With the same sourcetype we have two behaviour: If the length of that field is minor than 6000 it's indexed correctly, nevertheless if that field is greater than 6000 is being saved just the first element removing the rest of that field and stopping indexing the rest of the fields.
For example if event contains the follow info :
field1:"1231644", field2:"64614",field3:"sdfeee", field4:"ghdddfgd", field5:"1616",field6:"1231644",
field7:"xxxxxx1, xxxxxxx,xxxxxx2, xxxxxx3, xxxxxx4,xxxxxxx, xxxxxxx, xxxxxxx,xxxxxxx, xxxxxxx, xxxxxxx,xxxxxxx, xxxxxxx......xxxx12158",field8:"464641", field9:"7416",
When I extract info, it shows :
field1:1231644
field2:64614
field3:sdfeee
field4:ghdddfgd
field5:1616
field6:1231644
field7:"xxxxxx1
date:
index
So field8 ,field9 and following aren´t
... View more