Is there a way to measure the size of a field and then only keep XX bytes of it? I have some huge events coming in from Corelight and it’s all from one field within the event.
Every string has a .length property and every string has a
.substring() method. Combining those will enable you to keep X bytes.