Variable | MAX_EVENT_FIELD_COUNT_IN_PARSER | |
Introduced Version | 1.92.0 | |
Description | Specifies the number of fields allowed within the parser | |
Default | 50,000 fields |
A parser can temporarily have a higher number of fields in an event that is allowed when storing it. This allows specific uses; for example:
logscale
parseJson(field=@rawstring)
| drop(@rawstring)
| split(array)
will have more fields in the event after parseJson()
,
which are then split into multiple smaller events that all satisfy the
existing limit on the number of fields in an event being stored.
This configuration variable controls the number of fields allowed within the parser, but not when storing the event.