Large log records

OneAgent version 1.279+

Dynatrace version 1.281+

Preview

This feature is designed to be tested on no-production loads on agreed Dynatrace testing tenants. Deployment on production environments first must be consulted with Dynatrace specialists.

See below for important related constraints and tips on how to process large log data.

Logs ingested via OneAgent

Preview For logs ingested via OneAgent, the maximum supported length of a log record content field is 10 MB.

Generic log ingestion via API

For logs ingested via API, the maximum supported length of a log record content field is 64 kB.

Logs via extensions

For logs ingested via extensions, the maximum supported length of a log record content field is 64 kB.

Log processing

For log processing rules with matcher or processor definition touching log content, logs with content larger than 512 kB are not supported.

If log content exceeds 512 kB, the rule is not executed and the log record is saved to Grail without transformation .

Logs and events viewer

In the Logs and events viewer, the query result is limited to a maximum size of 64 MB and up to 1,000 log records.

If you don't see the expected results, try the following:

Run a more exact query or narrow down the timeframe.
Use the DQL substring function to limit large content. For example:
```
| fieldsAdd content=substring(content, 1000)
```

The result is incomplete

If the following message is displayed:

The result is incomplete. It contains records with a large payload which was trimmed.

This indicates that the 64 MB (64,000,000 Byte) maximum query result limit was reached.

To see the full results, select the link at the end of the message.

The record is incomplete

If the following message is displayed:

The record is incomplete. It contains records with a large payload which was trimmed.

This indicates that the content exceeded 5,000 chars and was trimmed to 5,000 chars.

To see the full record, select the link at the end of the message.

Notebooks, dashboards, in-product log tiles

Large content is supported in best-effort mode for notebooks, dashboards, and in-product log tiles.

Grail - DQL Query API

Use the Grail Query API as the primary access point for retrieving information stored within Grail. If you exceed the 64 GB internal data size limit for Grail:

Run a more exact query or narrow down the timeframe.
Use the DQL substring function to limit large content. For example:
```
| fieldsAdd content=substring(content, 1000)
```