Variable | MAX_EVENT_FIELD_COUNT_IN_PARSER | |
Introduced Version | 1.92.0 | |
Description | Controls the number of fields allowed within the parser | |
Default | 50,000 |
A parser can temporarily have a higher number of fields in an event that is allowed when storing it. This allows specific uses; for example:
logscale
parseJson(field=@rawstring)
| drop(@rawstring)
| split(array)
will have more fields in the event after parseJson()
,
which are then split into multiple smaller events that all satisfy the
existing limit on the number of fields in an event being stored.
This configuration variable controls the number of fields allowed within the parser, but not when storing the event.