Variable | MAX_EVENT_FIELD_COUNT | |
Description | Controls the enforced maximum number of fields in an event in the ingest phase | |
Default | 1,000 |
Controls the enforced maximum number of fields that can be parsed in an event during the ingest phase.
During ingest, fields are sorted alphabetically by name and the first
MAX_EVENT_FIELD_COUNT
are parsed, the remainder of the
named fields are dropped. Please note that the
@rawstring is not modified and will contain all data.