Is there a way to measure the size of a field and then only keep XX bytes of it?

Is there a way to measure the size of a field and then only keep XX bytes of it? I have some huge events coming in from Corelight and it’s all from one field within the event.

1 UpGoat

Every string has a .length property and every string has a .substring() method. Combining those will enable you to keep X bytes.

2 UpGoats