From e9d6ef3d017ff98fe4ee5f8916760398005d0363 Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Thu, 9 Jul 2026 13:26:15 +0530 Subject: [PATCH 1/5] DOCS-1738 - Document 256KB log message size support Update max log message size references from 64KB to 256KB across search, collection, and source docs; add a Known limitations section and LogCompare/LogReduce truncation notes; clarify the FER 64KB cap; and add a service release note. Co-Authored-By: Claude Opus 4.8 (1M context) --- blog-service/2026-07-09-search.md | 11 +++++++++++ docs/reuse/fer-limitations.md | 2 +- docs/search/behavior-insights/logcompare.md | 4 ++++ .../logreduce/detect-patterns-with-logreduce.md | 4 ++++ .../search-basics/search-large-messages.md | 17 +++++++++++++---- .../cloud-syslog-source/index.md | 4 ++-- .../qualys-vmdr-source.md | 2 +- .../collect-multiline-logs.md | 2 +- 8 files changed, 37 insertions(+), 9 deletions(-) create mode 100644 blog-service/2026-07-09-search.md diff --git a/blog-service/2026-07-09-search.md b/blog-service/2026-07-09-search.md new file mode 100644 index 00000000000..2be8adafa6b --- /dev/null +++ b/blog-service/2026-07-09-search.md @@ -0,0 +1,11 @@ +--- +title: Increased Maximum Log Message Size to 256KB (Search) +image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 +keywords: + - log message size + - large messages + - ingestion +hide_table_of_contents: true +--- + +We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs such as AWS CloudTrail, Google Cloud, and Microsoft 365 events are ingested without being split as often. Some features still handle messages at 64KB, including LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules. [Learn more](/docs/search/get-started-with-search/search-basics/search-large-messages/). diff --git a/docs/reuse/fer-limitations.md b/docs/reuse/fer-limitations.md index 57b7d6b6bb9..6295ad59112 100644 --- a/docs/reuse/fer-limitations.md +++ b/docs/reuse/fer-limitations.md @@ -6,5 +6,5 @@ Ingest Time FERs have the following limitations: ::: * Ingest Time rule expressions are limited to a maximum of 16k (16,384) characters. * Ingest Time rules can extract up to a maximum of 16k (16,384) characters for each field. -* The cumulative size of all fields extracted by a rule for a message/event is limited to 64kb. +* The cumulative size of all fields extracted by a rule for a message/event is limited to 64kb, regardless of the maximum log message size. * Ingest Time rules **only apply to data moving forward**. If you want to [parse](/docs/search/search-query-language/parse-operators) data ingested before the creation of your Ingest Time FER, you can either parse your data in your query, or create [Scheduled Views](/docs/manage/scheduled-views) to extract fields for your historical data. diff --git a/docs/search/behavior-insights/logcompare.md b/docs/search/behavior-insights/logcompare.md index 865e17bc428..06fc591a7c9 100644 --- a/docs/search/behavior-insights/logcompare.md +++ b/docs/search/behavior-insights/logcompare.md @@ -11,6 +11,10 @@ LogCompare allows you to easily compare log data from different time periods to For example, you could determine what was different right before a failure compared to the previous day or previous week. Or, you could easily check if a new release introduced a new issue by reviewing the difference in log streams across time. +:::note +LogCompare truncates raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not compared. This can also affect response time when you run LogCompare against large messages. +::: + ## How LogCompare works LogCompare creates a baseline (historical) query and compares it to a target (current) query. Logs from each query are clustered into patterns, called signatures, then compared and ranked based on the significance of change. diff --git a/docs/search/behavior-insights/logreduce/detect-patterns-with-logreduce.md b/docs/search/behavior-insights/logreduce/detect-patterns-with-logreduce.md index 15319c09ca5..56c09d55a8c 100644 --- a/docs/search/behavior-insights/logreduce/detect-patterns-with-logreduce.md +++ b/docs/search/behavior-insights/logreduce/detect-patterns-with-logreduce.md @@ -12,6 +12,10 @@ The **Signatures** tab displays LogReduce results as signatures. A signature You can refine the results of the LogReduce algorithm to make the outcome more generic or more specific. See [Influencing the LogReduce Outcome](influence-the-logreduce-outcome.md) for more information. +:::note +LogReduce truncates raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not included. This can also affect response time when you run LogReduce against large messages. +::: + ## Will my LogReduce search results match my keyword search results? Generally speaking, no. LogReduce is intended to be a jumping-off point for your analysis. Unlike a keyword search, where you are looking for data related to, say, a specific source or an error message, LogReduce returns signatures that contain messages that *may* be of interest to you using fuzzy logic. If you are not happy with a signature, you can [teach](influence-the-logreduce-outcome.md) LogReduce how you'd like the results to be made more specific. do not think of a signature as an example of what logs are grouped under it; instead think of a signature as a reflection of what LogReduce thinks you will find interesting if that signature catches your eye. Once you begin digging in to LogReduce results, you will then want to structure a keyword query that delivers precise results. diff --git a/docs/search/get-started-with-search/search-basics/search-large-messages.md b/docs/search/get-started-with-search/search-basics/search-large-messages.md index c8cc08f9b53..106d191157c 100644 --- a/docs/search/get-started-with-search/search-basics/search-large-messages.md +++ b/docs/search/get-started-with-search/search-basics/search-large-messages.md @@ -1,12 +1,12 @@ --- id: search-large-messages title: Search Large Messages -description: When collecting log messages or event logs that are larger than 64KB in size, Sumo Logic slices the messages into a stream of smaller message chunks. +description: When collecting log messages or event logs that are larger than 256KB in size, Sumo Logic slices the messages into a stream of smaller message chunks. --- -When collecting log messages or event logs that are larger than 64KB in size, Sumo Logic slices the messages into a stream of smaller message chunks. +When collecting log messages or event logs that are larger than 256KB in size, Sumo Logic slices the messages into a stream of smaller message chunks. Chunks are ideally created at a line break depending on the Source type, protocol, and size of the message. Each section of the large messages is annotated with metadata to keep the message in order when viewing or searching the log. @@ -16,8 +16,17 @@ For additional information on collecting large messages review the relevant [Sou ## Query to Identify Truncated Logs  -We have a [metadata](built-in-metadata.md) tag called `_size`. The `_size` metadata tag provides the size of the log message in bytes. A log is truncated at the size of 64K or 65536 bytes. +We have a [metadata](built-in-metadata.md) tag called `_size`. The `_size` metadata tag provides the size of the log message in bytes. A log is truncated at the size of 256K or 262144 bytes. To find truncated logs you can reference the `_size` metadata tag, an example would be using the where operator. -`| where _size = 65536` +`| where _size = 262144` + +## Known limitations + +Keep the following limitations in mind when you work with messages larger than 64KB: + +- **LogCompare and LogReduce**. These operators truncate raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not considered. This can also affect response time when you run them against large messages. Learn more in [LogReduce](/docs/search/behavior-insights/logreduce/) and [LogCompare](/docs/search/behavior-insights/logcompare/). +- **Log Search messages table**. When you view large messages, the messages table displays up to 25 messages per page. +- **Cloud SIEM**. Parsing and mapping might not process messages larger than 64KB correctly. +- **Field Extraction Rules**. The cumulative size of all fields extracted by a rule for a message is limited to 64KB, regardless of the message size. Learn more in [Field Extraction Rule limitations](/docs/manage/field-extractions/create-field-extraction-rule/#limitations). diff --git a/docs/send-data/hosted-collectors/cloud-syslog-source/index.md b/docs/send-data/hosted-collectors/cloud-syslog-source/index.md index 47d4015725c..67d299170e6 100644 --- a/docs/send-data/hosted-collectors/cloud-syslog-source/index.md +++ b/docs/send-data/hosted-collectors/cloud-syslog-source/index.md @@ -11,7 +11,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; You can configure a cloud syslog source to allow a syslog client to send [RFC 5424](https://tools.ietf.org/html/rfc5424)-compliant messages to Sumo Logic. A source-specific token, generated by Sumo Logic, is inserted into each message to identify the source. Transport Layer Security (TLS) 1.3 over TCP is required. -Syslog messages must be compliant with [RFC 5424](https://tools.ietf.org/html/rfc5424) or they are dropped. Messages over 64 KB are truncated. +Syslog messages must be compliant with [RFC 5424](https://tools.ietf.org/html/rfc5424) or they are dropped. Messages over 256 KB are truncated. Sumo Logic manages an elastic scaling set of syslog servers, which scales up and down behind a set of AWS Elastic Load Balancers. The AWS ELB set can also scale up and down. For this reason, instead of IP address-based endpoints, Sumo Logic uses endpoint hostnames in this format: @@ -103,7 +103,7 @@ Follow the configuration instructions for your syslog client: ### Message format -Syslog messages must be in RFC 5424-compliant form or they are dropped. Messages over 64KB in length are truncated. +Syslog messages must be in RFC 5424-compliant form or they are dropped. Messages over 256KB in length are truncated. This diagram shows the RFC 5424 format: diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/qualys-vmdr-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/qualys-vmdr-source.md index 085293e6cdf..5a1ecf09a37 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/qualys-vmdr-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/qualys-vmdr-source.md @@ -95,7 +95,7 @@ Click [here](/docs/c2c/info) for more information about Cloud-to-Cloud sources. ### Is anything changed with data for computer inventory? -Sometimes the asset information from the computer inventory data can exceed the [Sumo Logic maximum log size of 64KB](/docs/search/get-started-with-search/search-basics/search-large-messages/). Sumo Logic will automatically split log messages exceeding the size limit into smaller chunks. This C2C makes the following changes to the computer inventory asset data collected in order to keep most logs under the size limit and prevent splitting: +Sometimes the asset information from the computer inventory data can exceed the [Sumo Logic maximum log size of 256KB](/docs/search/get-started-with-search/search-basics/search-large-messages/). Sumo Logic will automatically split log messages exceeding the size limit into smaller chunks. This C2C makes the following changes to the computer inventory asset data collected in order to keep most logs under the size limit and prevent splitting: - The `openPortListData` key only contains information about ports open since the last time computer asset was ingested instead of listing all open port history from all time. - The `softwareListData` is reduced down from the full details to simply a list/array of software names using the full name. diff --git a/docs/send-data/reference-information/collect-multiline-logs.md b/docs/send-data/reference-information/collect-multiline-logs.md index fd09696e5a5..069167d0c36 100644 --- a/docs/send-data/reference-information/collect-multiline-logs.md +++ b/docs/send-data/reference-information/collect-multiline-logs.md @@ -15,7 +15,7 @@ The line breaks or carriage returns are control characters used to create new li Multiline messages that are more than 2,000 lines or 512KB in size will get flushed and collected as single log lines due to the default log message size limitations. Depending on the Collector's available memory, you may be able to increase this limit. Contact Support for assistance by navigating to **Help** > **Support** in the Sumo Logic menu. -Messages will be further broken down when they are received and indexed. When collecting log messages that are larger than 64KB in size, Sumo Logic slices the messages into a stream of smaller message chunks. Chunks are ideally created at a line break depending on the Source type, protocol, and size of the message. Each section of the large messages is annotated with metadata to keep the message in order when viewing or searching the log. Review the relevant Source's documentation for additional information. +Messages will be further broken down when they are received and indexed. When collecting log messages that are larger than 256KB in size, Sumo Logic slices the messages into a stream of smaller message chunks. Chunks are ideally created at a line break depending on the Source type, protocol, and size of the message. Each section of the large messages is annotated with metadata to keep the message in order when viewing or searching the log. Review the relevant Source's documentation for additional information. ## Multiline Processing Options From 1835d53a506b53dede52f8c67c9bdfab6792cf67 Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Tue, 21 Jul 2026 14:06:04 +0530 Subject: [PATCH 2/5] DOCS-1738 - Address review: results-table limit and release note sources Update the Log Search messages-table limitation to the GA behavior (table shows up to 64KB after expansion; full message via Log Message Inspector), and drop the unverified large-log source examples from the release note. Co-Authored-By: Claude Opus 4.8 (1M context) --- blog-service/2026-07-09-search.md | 2 +- .../search-basics/search-large-messages.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/blog-service/2026-07-09-search.md b/blog-service/2026-07-09-search.md index 2be8adafa6b..f229b158a1d 100644 --- a/blog-service/2026-07-09-search.md +++ b/blog-service/2026-07-09-search.md @@ -8,4 +8,4 @@ keywords: hide_table_of_contents: true --- -We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs such as AWS CloudTrail, Google Cloud, and Microsoft 365 events are ingested without being split as often. Some features still handle messages at 64KB, including LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules. [Learn more](/docs/search/get-started-with-search/search-basics/search-large-messages/). +We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs are ingested without being split as often. Some features still handle messages at 64KB, including LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules. [Learn more](/docs/search/get-started-with-search/search-basics/search-large-messages/). diff --git a/docs/search/get-started-with-search/search-basics/search-large-messages.md b/docs/search/get-started-with-search/search-basics/search-large-messages.md index 106d191157c..a8a3766f441 100644 --- a/docs/search/get-started-with-search/search-basics/search-large-messages.md +++ b/docs/search/get-started-with-search/search-basics/search-large-messages.md @@ -27,6 +27,6 @@ To find truncated logs you can reference the `_size` metadata tag, an example wo Keep the following limitations in mind when you work with messages larger than 64KB: - **LogCompare and LogReduce**. These operators truncate raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not considered. This can also affect response time when you run them against large messages. Learn more in [LogReduce](/docs/search/behavior-insights/logreduce/) and [LogCompare](/docs/search/behavior-insights/logcompare/). -- **Log Search messages table**. When you view large messages, the messages table displays up to 25 messages per page. +- **Log Search messages table**. The messages table displays up to 64KB of a message, even after you expand it. To view a complete message larger than 64KB, use the [Log Message Inspector](/docs/search/get-started-with-search/search-page/log-message-inspector). - **Cloud SIEM**. Parsing and mapping might not process messages larger than 64KB correctly. - **Field Extraction Rules**. The cumulative size of all fields extracted by a rule for a message is limited to 64KB, regardless of the message size. Learn more in [Field Extraction Rule limitations](/docs/manage/field-extractions/create-field-extraction-rule/#limitations). From c8ee1d17985bfad916c3583cb039afb16c1ae4eb Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Tue, 28 Jul 2026 11:33:37 +0530 Subject: [PATCH 3/5] DOCS-1773 - Document Slack and Jira Cloud webhook char limits Adds known-limitation notes for Slack's message truncation and Jira Cloud's 32,767-character issue description limit, called out directly on each webhook connection page and cross-linked from the central 256KB known limitations list, since larger messages make both limits more likely to be hit. --- docs/alerts/webhook-connections/jira-cloud.md | 4 ++++ docs/alerts/webhook-connections/slack.md | 4 ++++ .../search-basics/search-large-messages.md | 2 ++ 3 files changed, 10 insertions(+) diff --git a/docs/alerts/webhook-connections/jira-cloud.md b/docs/alerts/webhook-connections/jira-cloud.md index 8e6133311e9..c24c507da83 100644 --- a/docs/alerts/webhook-connections/jira-cloud.md +++ b/docs/alerts/webhook-connections/jira-cloud.md @@ -81,6 +81,10 @@ You need the **Manage connections** [role capability](/docs/manage/users-roles 1. To test the connection, click **Test Alert**. If successful, you'll see a `200 OK` response message. 1. Click **Save**. +## Known limitations + +The Jira Cloud issue description field has a hard limit of 32,767 characters, enforced at the database level. If a payload variable such as `{{ResultsJson}}` pushes the **Issue Description** past this limit, Jira Cloud returns a `400 Bad Request` error and the issue is not created. To avoid this, reference individual result fields (for example, `{{ResultsJson.fieldname}}`) instead of the full `{{ResultsJson}}` object, or otherwise keep the payload within the limit. + ## Create a Scheduled Search Scheduled searches are saved searches that run automatically at specified intervals. When a scheduled search is configured to send an alert, it can be sent to another tool using a webhook connection. diff --git a/docs/alerts/webhook-connections/slack.md b/docs/alerts/webhook-connections/slack.md index 3b0ca911fd1..113aead78ed 100644 --- a/docs/alerts/webhook-connections/slack.md +++ b/docs/alerts/webhook-connections/slack.md @@ -125,6 +125,10 @@ Here is an example JSON payload using Slack's **attachments** parameter: } ``` +## Known limitations + +Slack truncates long message content, such as `{{ResultsJson}}`, with "…" in the notification. This is a limitation of Slack's own message rendering, not of Sumo Logic. The full data remains intact at the source. Learn more in Slack's [changelog on truncating long messages](https://docs.slack.dev/changelog/2018-truncating-really-long-messages/). + ## Create an alert Once you set up the webhook connection, you'll have the option to use it in a [Scheduled Search](schedule-searches-webhook-connections.md) or [Monitor](/docs/alerts/monitors). diff --git a/docs/search/get-started-with-search/search-basics/search-large-messages.md b/docs/search/get-started-with-search/search-basics/search-large-messages.md index a8a3766f441..72495e7d6eb 100644 --- a/docs/search/get-started-with-search/search-basics/search-large-messages.md +++ b/docs/search/get-started-with-search/search-basics/search-large-messages.md @@ -30,3 +30,5 @@ Keep the following limitations in mind when you work with messages larger than 6 - **Log Search messages table**. The messages table displays up to 64KB of a message, even after you expand it. To view a complete message larger than 64KB, use the [Log Message Inspector](/docs/search/get-started-with-search/search-page/log-message-inspector). - **Cloud SIEM**. Parsing and mapping might not process messages larger than 64KB correctly. - **Field Extraction Rules**. The cumulative size of all fields extracted by a rule for a message is limited to 64KB, regardless of the message size. Learn more in [Field Extraction Rule limitations](/docs/manage/field-extractions/create-field-extraction-rule/#limitations). +- **Slack webhook connections**. Slack truncates long message content, such as `{{ResultsJson}}`, with "…" in the notification. Larger messages make this truncation more likely. Learn more in [Known limitations](/docs/alerts/webhook-connections/slack/#known-limitations). +- **Jira Cloud webhook connections**. The Jira Cloud issue description field has a hard limit of 32,767 characters. Larger messages make it more likely that a payload variable such as `{{ResultsJson}}` will exceed this limit and return a `400 Bad Request` error. Learn more in [Known limitations](/docs/alerts/webhook-connections/jira-cloud/#known-limitations). From 798c98168f3fe9adcb05e3ca337f3c3c82577440 Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Tue, 28 Jul 2026 12:26:14 +0530 Subject: [PATCH 4/5] DOCS-1773 - Clarify 256KB limitations by category, add Slack hard limit Adds Slack's 40,000-character hard limit, splits the search-large- messages known limitations into Sumo Logic platform vs. downstream webhook connection limitations for clarity, previews both in the intro, and tightens the release note with the same distinction. --- blog-service/2026-07-09-search.md | 10 +++++++++- docs/alerts/webhook-connections/slack.md | 2 +- .../search-basics/search-large-messages.md | 17 ++++++++++++++--- 3 files changed, 24 insertions(+), 5 deletions(-) diff --git a/blog-service/2026-07-09-search.md b/blog-service/2026-07-09-search.md index f229b158a1d..1123b8da58f 100644 --- a/blog-service/2026-07-09-search.md +++ b/blog-service/2026-07-09-search.md @@ -8,4 +8,12 @@ keywords: hide_table_of_contents: true --- -We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs are ingested without being split as often. Some features still handle messages at 64KB, including LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules. [Learn more](/docs/search/get-started-with-search/search-basics/search-large-messages/). +We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs are ingested without being split as often. + +**Sumo Logic platform limitations:** +* LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules still process messages at 64KB. + +**Downstream webhook connection limitations:** +* Slack (40,000 characters) and Jira Cloud (32,767 characters) enforce their own limits, which larger messages are more likely to reach. + +[Learn more](/docs/search/get-started-with-search/search-basics/search-large-messages/). diff --git a/docs/alerts/webhook-connections/slack.md b/docs/alerts/webhook-connections/slack.md index 113aead78ed..0859fb73c20 100644 --- a/docs/alerts/webhook-connections/slack.md +++ b/docs/alerts/webhook-connections/slack.md @@ -127,7 +127,7 @@ Here is an example JSON payload using Slack's **attachments** parameter: ## Known limitations -Slack truncates long message content, such as `{{ResultsJson}}`, with "…" in the notification. This is a limitation of Slack's own message rendering, not of Sumo Logic. The full data remains intact at the source. Learn more in Slack's [changelog on truncating long messages](https://docs.slack.dev/changelog/2018-truncating-really-long-messages/). +Slack has a hard limit of 40,000 characters per message. Content beyond this limit, such as a large `{{ResultsJson}}` value, is truncated with "…" in the notification. This is a limitation of Slack's own message rendering, not of Sumo Logic. The full data remains intact at the source. Learn more in Slack's [changelog on truncating long messages](https://docs.slack.dev/changelog/2018-truncating-really-long-messages/). ## Create an alert diff --git a/docs/search/get-started-with-search/search-basics/search-large-messages.md b/docs/search/get-started-with-search/search-basics/search-large-messages.md index 72495e7d6eb..c00e8a46c9c 100644 --- a/docs/search/get-started-with-search/search-basics/search-large-messages.md +++ b/docs/search/get-started-with-search/search-basics/search-large-messages.md @@ -14,6 +14,8 @@ See [Collecting Multiline Logs](/docs/send-data/reference-information/collect-mu For additional information on collecting large messages review the relevant [Source's documentation](/docs/send-data/choose-collector-source). +Some Sumo Logic platform features handle messages larger than 64KB differently, and alert notifications sent to downstream tools like Slack and Jira Cloud can hit character limits of their own. See [Known limitations](#known-limitations) for details. + ## Query to Identify Truncated Logs  We have a [metadata](built-in-metadata.md) tag called `_size`. The `_size` metadata tag provides the size of the log message in bytes. A log is truncated at the size of 256K or 262144 bytes. @@ -24,11 +26,20 @@ To find truncated logs you can reference the `_size` metadata tag, an example wo ## Known limitations -Keep the following limitations in mind when you work with messages larger than 64KB: +Keep the following limitations in mind when you work with messages larger than 64KB. + +### Sumo Logic platform limitations + +These features process large messages differently within Sumo Logic itself: - **LogCompare and LogReduce**. These operators truncate raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not considered. This can also affect response time when you run them against large messages. Learn more in [LogReduce](/docs/search/behavior-insights/logreduce/) and [LogCompare](/docs/search/behavior-insights/logcompare/). - **Log Search messages table**. The messages table displays up to 64KB of a message, even after you expand it. To view a complete message larger than 64KB, use the [Log Message Inspector](/docs/search/get-started-with-search/search-page/log-message-inspector). - **Cloud SIEM**. Parsing and mapping might not process messages larger than 64KB correctly. - **Field Extraction Rules**. The cumulative size of all fields extracted by a rule for a message is limited to 64KB, regardless of the message size. Learn more in [Field Extraction Rule limitations](/docs/manage/field-extractions/create-field-extraction-rule/#limitations). -- **Slack webhook connections**. Slack truncates long message content, such as `{{ResultsJson}}`, with "…" in the notification. Larger messages make this truncation more likely. Learn more in [Known limitations](/docs/alerts/webhook-connections/slack/#known-limitations). -- **Jira Cloud webhook connections**. The Jira Cloud issue description field has a hard limit of 32,767 characters. Larger messages make it more likely that a payload variable such as `{{ResultsJson}}` will exceed this limit and return a `400 Bad Request` error. Learn more in [Known limitations](/docs/alerts/webhook-connections/jira-cloud/#known-limitations). + +### Downstream webhook connection limitations + +Alert notifications sent to these tools can also be affected by character limits that are fixed by the tool itself, independent of Sumo Logic's message size. Larger messages make these limits more likely to be reached: + +- **Slack webhook connections**. Slack has a hard limit of 40,000 characters per message. Content beyond this limit, such as a large `{{ResultsJson}}` value, is truncated with "…" in the notification. Learn more in [Known limitations](/docs/alerts/webhook-connections/slack/#known-limitations). +- **Jira Cloud webhook connections**. The Jira Cloud issue description field has a hard limit of 32,767 characters. A payload variable such as `{{ResultsJson}}` that exceeds this limit returns a `400 Bad Request` error. Learn more in [Known limitations](/docs/alerts/webhook-connections/jira-cloud/#known-limitations). From 4a6dd93cbe308251fa5098d35025800382d373be Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Thu, 6 Aug 2026 16:06:08 +0530 Subject: [PATCH 5/5] DOCS-1738 - Address GNG review: table limit, Jira Cloud truncation, release note - Correct the Log Search messages table limit from 64KB to the GA value of 25,000 characters, and note that JSON values in larger messages aren't rendered as JSON fields by default (per ssharma-sumo). - Correct Jira Cloud webhook behavior: oversized descriptions are truncated with "..." and the issue is still created, not a 400 Bad Request failure (per lei-sumo). - Drop the release note's summarized limitations bullets, which mischaracterized the Field Extraction Rule limit as a message-size cap rather than a cumulative-field-size cap (per kevin-sumo/lei-sumo), and link to the doc's Known limitations section instead. --- blog-service/2026-07-09-search.md | 6 +----- docs/alerts/webhook-connections/jira-cloud.md | 2 +- .../search-basics/search-large-messages.md | 4 ++-- 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/blog-service/2026-07-09-search.md b/blog-service/2026-07-09-search.md index 1123b8da58f..d0843453d24 100644 --- a/blog-service/2026-07-09-search.md +++ b/blog-service/2026-07-09-search.md @@ -10,10 +10,6 @@ hide_table_of_contents: true We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs are ingested without being split as often. -**Sumo Logic platform limitations:** -* LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules still process messages at 64KB. - -**Downstream webhook connection limitations:** -* Slack (40,000 characters) and Jira Cloud (32,767 characters) enforce their own limits, which larger messages are more likely to reach. +Some Sumo Logic platform features and downstream webhook connections handle messages larger than 64KB differently. See [Known limitations](/docs/search/get-started-with-search/search-basics/search-large-messages/#known-limitations) for details. [Learn more](/docs/search/get-started-with-search/search-basics/search-large-messages/). diff --git a/docs/alerts/webhook-connections/jira-cloud.md b/docs/alerts/webhook-connections/jira-cloud.md index c24c507da83..3966ae9ef27 100644 --- a/docs/alerts/webhook-connections/jira-cloud.md +++ b/docs/alerts/webhook-connections/jira-cloud.md @@ -83,7 +83,7 @@ You need the **Manage connections** [role capability](/docs/manage/users-roles ## Known limitations -The Jira Cloud issue description field has a hard limit of 32,767 characters, enforced at the database level. If a payload variable such as `{{ResultsJson}}` pushes the **Issue Description** past this limit, Jira Cloud returns a `400 Bad Request` error and the issue is not created. To avoid this, reference individual result fields (for example, `{{ResultsJson.fieldname}}`) instead of the full `{{ResultsJson}}` object, or otherwise keep the payload within the limit. +The Jira Cloud issue description field has a hard limit of 32,767 characters. If a payload variable such as `{{ResultsJson}}` pushes the **Issue Description** past this limit, Jira Cloud truncates the description with "…" and creates the issue with the truncated content. To retain the full data, reference individual result fields (for example, `{{ResultsJson.fieldname}}`) instead of the full `{{ResultsJson}}` object, or otherwise keep the payload within the limit. ## Create a Scheduled Search diff --git a/docs/search/get-started-with-search/search-basics/search-large-messages.md b/docs/search/get-started-with-search/search-basics/search-large-messages.md index c00e8a46c9c..95d27084d7b 100644 --- a/docs/search/get-started-with-search/search-basics/search-large-messages.md +++ b/docs/search/get-started-with-search/search-basics/search-large-messages.md @@ -33,7 +33,7 @@ Keep the following limitations in mind when you work with messages larger than 6 These features process large messages differently within Sumo Logic itself: - **LogCompare and LogReduce**. These operators truncate raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not considered. This can also affect response time when you run them against large messages. Learn more in [LogReduce](/docs/search/behavior-insights/logreduce/) and [LogCompare](/docs/search/behavior-insights/logcompare/). -- **Log Search messages table**. The messages table displays up to 64KB of a message, even after you expand it. To view a complete message larger than 64KB, use the [Log Message Inspector](/docs/search/get-started-with-search/search-page/log-message-inspector). +- **Log Search messages table**. The messages table displays up to 25,000 characters of a message, even after you expand it. If a message larger than 25,000 characters contains JSON values as strings, those values are not rendered as JSON fields by default in the table. To view a complete message, or to view large JSON values as structured JSON, use the [Log Message Inspector](/docs/search/get-started-with-search/search-page/log-message-inspector). - **Cloud SIEM**. Parsing and mapping might not process messages larger than 64KB correctly. - **Field Extraction Rules**. The cumulative size of all fields extracted by a rule for a message is limited to 64KB, regardless of the message size. Learn more in [Field Extraction Rule limitations](/docs/manage/field-extractions/create-field-extraction-rule/#limitations). @@ -42,4 +42,4 @@ These features process large messages differently within Sumo Logic itself: Alert notifications sent to these tools can also be affected by character limits that are fixed by the tool itself, independent of Sumo Logic's message size. Larger messages make these limits more likely to be reached: - **Slack webhook connections**. Slack has a hard limit of 40,000 characters per message. Content beyond this limit, such as a large `{{ResultsJson}}` value, is truncated with "…" in the notification. Learn more in [Known limitations](/docs/alerts/webhook-connections/slack/#known-limitations). -- **Jira Cloud webhook connections**. The Jira Cloud issue description field has a hard limit of 32,767 characters. A payload variable such as `{{ResultsJson}}` that exceeds this limit returns a `400 Bad Request` error. Learn more in [Known limitations](/docs/alerts/webhook-connections/jira-cloud/#known-limitations). +- **Jira Cloud webhook connections**. The Jira Cloud issue description field has a hard limit of 32,767 characters. Content beyond this limit, such as a large `{{ResultsJson}}` value, is truncated with "…" and the issue is still created. Learn more in [Known limitations](/docs/alerts/webhook-connections/jira-cloud/#known-limitations).