DOCS-1738 - Document 256KB log message size support#6881
Draft
JV0812 wants to merge 1 commit into
Draft
Conversation
Update max log message size references from 64KB to 256KB across search, collection, and source docs; add a Known limitations section and LogCompare/LogReduce truncation notes; clarify the FER 64KB cap; and add a service release note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
lei-sumo
reviewed
Jul 10, 2026
| Keep the following limitations in mind when you work with messages larger than 64KB: | ||
|
|
||
| - **LogCompare and LogReduce**. These operators truncate raw 256KB messages to 64KB before matching and grouping the logs into signatures, so content beyond 64KB is not considered. This can also affect response time when you run them against large messages. Learn more in [LogReduce](/docs/search/behavior-insights/logreduce/) and [LogCompare](/docs/search/behavior-insights/logcompare/). | ||
| - **Log Search messages table**. When you view large messages, the messages table displays up to 25 messages per page. |
There was a problem hiding this comment.
This 25 msg/page UI limitation will be removed as part of the GA based on this comment: https://sumologic.slack.com/archives/C02DUQT0A/p1783604422222719?thread_ts=1777391223.682879&cid=C02DUQT0A
The new behavior is that search page will only show upto 64kb in the results table (after expansion), but the complete individual message can be viewed in the message inspector
lei-sumo
reviewed
Jul 10, 2026
| hide_table_of_contents: true | ||
| --- | ||
|
|
||
| We're excited to announce that Sumo Logic now supports a maximum log message size of **256KB**, up from 64KB, so large single-line logs such as AWS CloudTrail, Google Cloud, and Microsoft 365 events are ingested without being split as often. Some features still handle messages at 64KB, including LogCompare, LogReduce, Cloud SIEM parsing, and Field Extraction Rules. [Learn more](/docs/search/get-started-with-search/search-basics/search-large-messages/). |
There was a problem hiding this comment.
AWS CloudTrail, Google Cloud, and Microsoft 365 events - are they known large log sources?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of this pull request
This pull request documents the increase of the maximum log message size from 64KB to 256KB, calls out the known limitations, and adds a service release note.
Changes:
_sizetruncation from 65536 to 262144) insearch-large-messages.md,collect-multiline-logs.md,cloud-syslog-source/index.md, andqualys-vmdr-source.md.search-large-messages.md(LogCompare/LogReduce, UI 25-messages-per-page, Cloud SIEM, FER).logcompare.mdanddetect-patterns-with-logreduce.md.fer-limitations.mdthat the 64KB cumulative field cap applies regardless of message size.blog-service/2026-07-09-search.md.Open items to confirm before marking ready
Select the type of change
Ticket (if applicable)
https://sumologic.atlassian.net/browse/DOCS-1738 (epic: SUMO-288529)