VariableMAX_EVENT_FIELD_COUNT
Description Controls the enforced maximum number of fields in an event in the ingest phase
Default1,000

Controls the enforced maximum number of fields that can be parsed in an event during the ingest phase.

During ingest, fields are sorted alphabetically by name and the first MAX_EVENT_FIELD_COUNT are parsed, the remainder of the named fields are dropped. Please note that the @rawstring is not modified and will contain all data.