Overview

[#1]

The maximum meta value limit for Decoder and Log Decoder has always been 256 bytes. This means that when a Packet Decoder or Log Decoder (hereafter collectively referred to as “Decoder”) parses raw data and generates meta, the values of that meta cannot exceed 256 bytes. If the raw value exceeds that limit, it will be truncated to the first 256 bytes, and only those bytes will be parsed and indexed.

This presents a challenge because meta such as URL Query Strings or PowerShell Commands sometimes contain values that exceed 256 bytes.

Note: The Extended Meta Feature allows configuring certain meta keys to support values greater than 256 bytes.

Extended Meta can have significant impacts on multiple areas of Core, including (but not limited to) data retention, queries, and aggregation. The purpose of this document is to guide users on how to add extended meta to their environment without impacting performance too drastically.