Problem
Not all log data in a message or for a specific attribute is being displayed. The log data ends with an ellipsis (...) and the remaining data isn't shown.
Solution
This occurs because the logs datastore in New Relic limits the field length to 4,094 characters. Any data longer than that is truncated during ingestion.
If you have values exceeding the character limit, here are some options to try:
Troubleshooting tips | Comments |
|---|---|
Parse long messages | Parse your log message into shorter key/value pairs. A common example is a single log line from an NGINX access log. That log message can be parsed using built-in parsing via Logstash, Fluentd, or Fluent Bit. For more information, see our documentation about parsing log data. |
Use JSON output | Use JSON as an output format instead of plain text. JSON log messages will automatically be parsed into key/value pairs, which makes it much less likely to hit the character limit. |
Expand blob data | The first 4,094 characters in a log message are stored as a string. The next 128,000 bytes are stored as a To query for logs that have likely exceeded this storage limit in New Relic, run the following query: To expand the blob data, run the following query, using For more information, see our documentation about long messages stored as blobs. |