Truncation with [processors.regex] of a multiline message does not work

Telegraf
,
1

Hi,
I would like to shorten the content of a multiline field from xxx characters. This regx works in a Regex Online Tester.
(?m) (. {50}?). *$
In the telegraph, however, each line is truncated after 50 characters:

[[processors.regex]]
  namepass = ["win_eventlog"]
 [[processors.regex.fields]]
    ## Field to change
    key = "Message"
    pattern = "(?m)(.{ 50}?). *$"
    replacement = "${1} - message has been truncated"

What can I do to ensure that the whole message is truncated after xxx characters and not every line?
Regards Markus

2
  • Which input plugin is used to capture this?
  • Have you checked if the message field actually has a multi-line content? It could also already be split by the input plugin?
  • Can you post an example of a multi-line message?