DOCS-1738 - Document 256KB log message size support - #6881
Conversation
Update max log message size references from 64KB to 256KB across search, collection, and source docs; add a Known limitations section and LogCompare/LogReduce truncation notes; clarify the FER 64KB cap; and add a service release note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update the Log Search messages-table limitation to the GA behavior (table shows up to 64KB after expansion; full message via Log Message Inspector), and drop the unverified large-log source examples from the release note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Holding off on approval — the PR description lists three open items still unconfirmed:
Could you confirm these and check the boxes before this goes up for merge? The doc mechanics (links, cross-references, consistency of the 64KB→256KB updates across all affected files) all check out — just want the factual claims nailed down first. |
Adds known-limitation notes for Slack's message truncation and Jira Cloud's 32,767-character issue description limit, called out directly on each webhook connection page and cross-linked from the central 256KB known limitations list, since larger messages make both limits more likely to be hit.
Adds Slack's 40,000-character hard limit, splits the search-large- messages known limitations into Sumo Logic platform vs. downstream webhook connection limitations for clarity, previews both in the intro, and tightens the release note with the same distinction.
| We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs are ingested without being split as often. | ||
|
|
||
| **Sumo Logic platform limitations:** | ||
| * LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules still process messages at 64KB. |
There was a problem hiding this comment.
Is this Field Extraction Rule limitation accurate? This makes it sound like FER will only work if the log is <64kb. I thought the limit was in the volume extracted?
| These features process large messages differently within Sumo Logic itself: | ||
|
|
||
| - **LogCompare and LogReduce**. These operators truncate raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not considered. This can also affect response time when you run them against large messages. Learn more in [LogReduce](/docs/search/behavior-insights/logreduce/) and [LogCompare](/docs/search/behavior-insights/logcompare/). | ||
| - **Log Search messages table**. The messages table displays up to 64KB of a message, even after you expand it. To view a complete message larger than 64KB, use the [Log Message Inspector](/docs/search/get-started-with-search/search-page/log-message-inspector). |
There was a problem hiding this comment.
After this feature is released, the message table will display messages up to approximately 25 KB.
@JV0812, could you please update this?
Also, please add a note that messages larger than 25 KB containing JSON values as strings will not be rendered as JSON fields by default in the table. To view them as structured JSON, users will need to open the message in the Message Explorer.
YOu can read more on this thread https://sumologic.slack.com/archives/C09NL5MKJUS/p1784608962471479?thread_ts=1779369449.778359&cid=C09NL5MKJUS
5 participants
Purpose of this pull request
This pull request documents the increase of the maximum log message size from 64KB to 256KB, calls out the known limitations, and adds a service release note.
Changes:
_sizetruncation from 65536 to 262144) insearch-large-messages.md,collect-multiline-logs.md,cloud-syslog-source/index.md, andqualys-vmdr-source.md.search-large-messages.md(LogCompare/LogReduce, UI 25-messages-per-page, Cloud SIEM, FER).logcompare.mdanddetect-patterns-with-logreduce.md.fer-limitations.mdthat the 64KB cumulative field cap applies regardless of message size.blog-service/2026-07-09-search.md.Open items to confirm before marking ready
Select the type of change
Ticket (if applicable)
https://sumologic.atlassian.net/browse/DOCS-1738 (epic: SUMO-288529)