max_scan_bytes

Maximum number of bytes to scan when searching for JSON content in find-json mode.

This parameter applies to JSON Structured Content Extraction Module (mmjsonparse).

Name:

max_scan_bytes

Scope:

action

Type:

positive integer

Default:

65536

Required?:

no

Introduced:

8.2506.0

Description

Sets the maximum number of bytes to scan when searching for JSON objects in find-json mode. This prevents performance issues with very large messages by limiting the amount of data that will be examined.

When the scan limit is reached without finding a complete JSON object, the message is treated as non-JSON and processed through the fallback path (creating a simple JSON object with the original message as the “msg” field).

This parameter is only effective when mode=”find-json”.

Input usage

# Scan up to 32KB for JSON content
action(type="mmjsonparse" mode="find-json" max_scan_bytes="32768")

# Use default 64KB scan limit
action(type="mmjsonparse" mode="find-json")

See also

See also the main mmjsonparse module documentation.

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.