DOCS-1738 - Document 256KB log message size support - #6881
Open
JV0812 wants to merge 4 commits into
Open
Conversation
Update max log message size references from 64KB to 256KB across search, collection, and source docs; add a Known limitations section and LogCompare/LogReduce truncation notes; clarify the FER 64KB cap; and add a service release note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
lei-sumo
reviewed
Jul 10, 2026
lei-sumo
reviewed
Jul 10, 2026
Update the Log Search messages-table limitation to the GA behavior (table shows up to 64KB after expansion; full message via Log Message Inspector), and drop the unverified large-log source examples from the release note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collaborator
|
Holding off on approval — the PR description lists three open items still unconfirmed:
Could you confirm these and check the boxes before this goes up for merge? The doc mechanics (links, cross-references, consistency of the 64KB→256KB updates across all affected files) all check out — just want the factual claims nailed down first. |
Adds known-limitation notes for Slack's message truncation and Jira Cloud's 32,767-character issue description limit, called out directly on each webhook connection page and cross-linked from the central 256KB known limitations list, since larger messages make both limits more likely to be hit.
Adds Slack's 40,000-character hard limit, splits the search-large- messages known limitations into Sumo Logic platform vs. downstream webhook connection limitations for clarity, previews both in the intro, and tightens the release note with the same distinction.
kevin-sumo
reviewed
Jul 28, 2026
| We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs are ingested without being split as often. | ||
|
|
||
| **Sumo Logic platform limitations:** | ||
| * LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules still process messages at 64KB. |
Collaborator
There was a problem hiding this comment.
Is this Field Extraction Rule limitation accurate? This makes it sound like FER will only work if the log is <64kb. I thought the limit was in the volume extracted?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of this pull request
This pull request documents the increase of the maximum log message size from 64KB to 256KB, calls out the known limitations, and adds a service release note.
Changes:
_sizetruncation from 65536 to 262144) insearch-large-messages.md,collect-multiline-logs.md,cloud-syslog-source/index.md, andqualys-vmdr-source.md.search-large-messages.md(LogCompare/LogReduce, UI 25-messages-per-page, Cloud SIEM, FER).logcompare.mdanddetect-patterns-with-logreduce.md.fer-limitations.mdthat the 64KB cumulative field cap applies regardless of message size.blog-service/2026-07-09-search.md.Open items to confirm before marking ready
Select the type of change
Ticket (if applicable)
https://sumologic.atlassian.net/browse/DOCS-1738 (epic: SUMO-288529)