Graylog GELF max field size Graylog GELF max field size elasticsearch elasticsearch

Graylog GELF max field size


Graylog and the GELF protocol itself don't have any size restrictions but it should be noted that Lucene (the library underlying Elasticsearch) has a limit of 32 KiB per field for analyzed fields (e. g. the "message" and "full_message" fields of a GELF message).

Given that the default encoding in Elasticsearch and Graylog is UTF-8, the 20.000 characters could approximately match the maximum field size of 32 KiB (for analyzed fields). Non-analyzed fields can be (almost) arbitrarily big.

See https://github.com/Graylog2/graylog2-server/issues/873 for a related issue on GitHub.