large event

[doc dodo]

Hello,

I have decoder 

<decoder name="INM_net_activity">
  <prematch>"LogType":"net_activity"</prematch>
  <plugin_decoder>JSON_Decoder</plugin_decoder>
  <json_null_field>discard</json_null_field>
</decoder>

And event of very large size

{"TimestampUTC":"2026-08-06T12:14:55.869654Z","FlowId":1594284475292513,"ParentId":0,"CommunityId":"","InIface":"enP4p65s0","EventType":"flow","IpType":"IPv4","SrcIp":"192.168.150.149","SrcPort":61489,"DestIp":"192.168.150.97","DestPort":161,"Proto":"UDP","AppProto":"snmp","AppProtoExpected":"","AppProtoOrig":"","AppProtoTc":"","AppProtoTs":"","PktSrc":"","Direction":"","CaptureFile":"","LogLevel":"","Packet":"","IcmpCode":0,"IcmpType":0,"ResponseIcmpCode":0,"ResponseIcmpType":0,"TxId":0,"Vlan":null,"PcapCnt":0,"PcapFilename":"","Host":"","Payload":"","PayloadLength":0,"PayloadPrintable":"","Spi":0,"Stream":0,"AlertAction":"","AlertGid":0,"AlertSignatureID":0,"AlertRev":0,"AlertSignature":"","AlertCategory":"","AlertSeverity":"","AlertRule":"","AlertXff":"","AlertReferences":null,"AlertTargetIp":"","AlertTargetPort":0,"AlertSourceIp":"","AlertSoursePort":0,"AlertMetadataAffectedProduct":null,"AlertMetadataAttackTarget":null,"AlertMetadataCreatedAt":null,"AlertMetadataDeployment":null,"AlertMetadataFormerCategory":null,"AlertMetadataMalwareFamily":null,"AlertMetadataPolicy":null,"AlertMetadataTag":null,"AlertMetadataUpdatedAt":null,"AlertMetadataLateralAsset":null,"AlertMetadataLateralFunction":null,"AlertMetadataLateralKey":null,"AlertMetadataProvider":null,"AlertMetadataSource":null,"AlertMetadataStamusClassification":null,"AlertMetadataMitreTacticId":null,"AlertMetadataMitreTacticName":null,"AlertMetadataMitreTechniqueId":null,"AlertMetadataMitreTechniqueName":null,"AlertMetadataConfidence":null,"AlertMetadataPerformanceImpact":null,"AlertMetadataReviewedAt":null,"AlertMetadata":"{}","AnomalyAppProto":"","AnomalyType":"","AnomalyEvent":"","AnomalyLayer":"","AnomalyCode":0,"ArpHwType":"","ArpProtoType":"","ArpOpcode":"","ArpSrcMac":"","ArpSrcIp":"","ArpDestMac":"","ArpDestIp":"","HttpHostname":"","HttpHTTPPort":0,"HttpURL":"","HttpHTTPUserAgent":"","HttpHTTPContentType":"","HttpHTTPRefer":"","HttpHTTPMethod":"","HttpProtocol":"","HttpStatus":0,"HttpStatusString":"","HttpLength":0,"HttpHTTPResponseBody":"","HttpHTTPResponseBodyPrintable":"","HttpOrgSrcIp":"","HttpRedirect":"","HttpTrueClientIp":"","HttpVersion":"","HttpXBluecoatVia":"","HttpXff":"","HttpContentRangeStart":0,"HttpContentRangeEnd":0,"HttpContentRangeRaw":"","HttpContentRangeSize":0,"HttpHTTP2StreamId":0,"HttpHTTP2ResponseErrorCode":"","HttpHTTP2RequestErrorCode":"","HttpHTTP2RequestPriority":0,"DnsVersion":0,"DnsType":"","DnsID":0,"DnsRrname":"","DnsRrtype":"","DnsRcode":"","DnsFlags":"","DnsAA":false,"DnsQR":false,"DnsRA":false,"DnsRD":false,"DnsTC":false,"DnsZ":false,"DnsTxId":0,"DnsOpcode":0,"DnsAnswerFlags":"","DnsAnswerId":0,"DnsAnswerQR":false,"DnsAnswerRA":false,"DnsAnswerRcode":"","DnsAnswerRD":false,"DnsAnswerRrname":"","DnsAnswerRrtype":"","DnsAnswerType":"","DnsAnswerVersion":0,"DnsAnswerOpcode":0,"DnsGroupedA":null,"DnsGroupedAAAA":null,"DnsGroupedCNAME":null,"DnsGroupedMX":null,"DnsGroupedNS":null,"DnsGroupedNULL":null,"DnsGroupedPTR":null,"DnsGroupedTXT":null,"TlsSubject":"","TlsIssuerdn":"","TlsFingerprint":"","TlsSni":"","TlsVersion":"","TlsNotbefore":"","TlsNotafter":"","TlsSerial":"","TlsCertificate":"","TlsChain":null,"TlsClientAlpns":null,"TlsServerAlpns":null,"TlsFromProto":"","TlsSubjectaltname":null,"TlsSessionResumed":false,"TlsJa4":"","TlsJa3sHash":"","TlsJa3sString":"","TlsJa3Hash":"","TlsJa3String":"","TlsClientCertificate":"","TlsClientChain":null,"TlsClientFingerprint":"","TlsClientIsssuerdn":"","TlsClientSubjectaltname":null,"TlsClientNotafter":"","TlsClientNotbefore":"","TlsClientSerial":"","TlsClientSubject":"","TunnelDepth":0,"TunnelSrcIp":"","TunnelSrcPort":0,"TunnelDestIp":"","TunnelDestPort":0,"TunnelPcapCnt":0,"TunnelPktSrc":"","TunnelProto":"","TrafficId":null,"TrafficLabel":null,"TcpAck":false,"TcpCwr":false,"TcpEcn":false,"TcpFin":false,"TcpPsh":false,"TcpRst":false,"TcpState":"","TcpSyn":false,"TcpTcGap":false,"TcpTcMaxRegions":0,"TcpTcpFlags":"","TcpTcpFlagsTc":"","TcpTcpFlagsTs":"","TcpTsGap":false,"TcpTsMaxRegions":0,"TcpUrg":false,"SshClientProtoVersion":"","SshClientSoftwareVersion":"","SshClientHasshHash":"","SshClientHasshString":"","SshServerProtoVersion":"","SshServerSoftwareVersion":"","SshServerHasshHash":"","SshServerHasshString":"","FlowPktsToserver":1,"FlowPktsToclient":1,"FlowBytesToserver":91,"FlowBytesToclient":95,"FlowStart":"2026-08-06T12:09:49Z","FlowEnd":"2026-08-06T12:09:49Z","FlowAge":0,"FlowState":"established","FlowReason":"timeout","FlowAlerted":false,"FlowAction":"","FlowBypass":"","FlowDestIp":"","FlowDestPort":0,"FlowSrcIp":"","FlowSrcPort":0,"FlowEmergency":false,"FlowWrongThread":false,"FlowBypassedPktsToserver":0,"FlowBypassedPktsToclient":0,"FlowBypassedBytesToserver":0,"FlowBypassedBytesToclient":0,"SnmpVersion":0,"SnmpPduType":"","SnmpVars":null,"SnmpCommunity":"","SnmpUsm":"","SnmpError":"","FtpCommand":"","FtpCommandData":"","FtpCommandTruncated":false,"FtpCompletionCode":null,"FtpReply":null,"FtpReplyReceived":"","FtpReplyTruncated":false,"FtpDynamicPort":0,"FtpMode":"","FTPDataCommand":"","FTPDataFilename":"","SmbID":0,"SmbDialect":"","SmbCommand":"","SmbSessionID":0,"SmbTreeID":0,"SmbClientDialects":null,"SmbServerGuid":"","SmbAccess":"","SmbAccessed":0,"SmbChanged":0,"SmbClientGuid":"","SmbCreated":0,"SmbDirectory":"","SmbDisposition":"","SmbFilename":"","SmbFuid":"","SmbFunction":"","SmbLevelOfInterest":"","SmbMaxReadSize":0,"SmbMaxWriteSize":0,"SmbModified":0,"SmbNamedPipe":"","SmbRequestDone":false,"SmbResponseDone":false,"SmbShare":"","SmbShareType":"","SmbSize":0,"SmbSubcmd":"","SmbStatus":"","SmbStatusCode":"","SmbServiceRequest":"","SmbServiceResponse":"","SmbResponseNativeLm":"","SmbResponseNativeOs":"","SmbRequestNativeLm":"","SmbRequestNativeOs":"","SmbNtlmsspDomain":"","SmbNtlmsspHost":"","SmbNtlmsspUser":"","SmbNtlmsspVersion":"","SmbNtlmsspWarning":false,"SmbKerberosRealm":"","SmbKerberosSnames":null,"SmbRenameFrom":"","SmbRenameTo":"","SmbSetInfoClass":"","SmbSetInfoLevel":"","SmbDcerpcCallId":0,"SmbDcerpcOpnum":0,"SmbDcerpcRequest":"","SmbDcerpcResponse":"","SmbDcerpcResFragCnt":0,"SmbDcerpcResStubDataSize":0,"SmbDcerpcReqFragCnt":0,"SmbDcerpcReqStubDataSize":0,"DhcpType":"","DhcpID":0,"DhcpClientMac":"","DhcpAssignedIp":"","DhcpDhcpType":"","DhcpClientId":"","DhcpClientIp":"","DhcpHostname":"","DhcpLeaseTime":0,"DhcpNextServerIp":"","DhcpRebindingTime":0,"DhcpRelayIp":"","DhcpRenewalTime":0,"DhcpRequestedIp":"","DhcpSubnetMask":"","DhcpVendorClassIdentifier":"","DhcpDnsServers":null,"DhcpParams":null,"DhcpRouters":null,"DcerpcRequest":"","DcerpcResponse":"","DcerpcCallID":0,"DcerpcRpcVersion":"","DcerpcActivityuuid":"","DcerpcSeqnum":0,"DcerpcReqFragCnt":0,"DcerpcReqOpnum":0,"DcerpcReqStubDataSize":0,"DcerpcResFragCnt":0,"DcerpcResStubDataSize":0,"SipMethod":"","SipURI":"","SipVersion":"","SipRequestLine":"","SipResponseLine":"","SipCode":"","SipReason":"","SipSdpVersion":0,"SipSdpOrigin":"","SipSdpSessionName":"","SipSdpSessionInfo":"","SipSdpUri":"","SipSdpEmail":"","SipSdpPhoneNumber":"","SipSdpConnectionData":"","SipSdpTime":"","SipSdpRepeatTime":"","SipSdpTimezone":"","SipSdpEncryptionKey":"","SipSdpBandwidths":null,"SipSdpAttributes":null,"FileInfoFilename":"","FileInfoMagic":"","FileInfoGaps":false,"FileInfoState":"","FileInfoStored":false,"FileInfoSize":0,"FileInfoTxID":0,"FileInfoStart":0,"FileInfoEnd":0,"FileInfoFileId":0,"FileInfoMd5":"","FileInfoSha1":"","FileInfoSha256":"","FileInfoSid":null,"RdpTxID":0,"RdpEventType":"","RdpCookie":"","RdpChannels":null,"RdpProtocol":"","RdpServerSupports":null,"RdpX509Serials":null,"RdpClientBuild":"","RdpClientClientName":"","RdpClientColorDepth":0,"RdpClientDesktopHeight":0,"RdpClientDesktopWidth":0,"RdpClientFunctionKeys":0,"RdpClientId":"","RdpClientKeyboardLayout":"","RdpClientKeyboardType":"","RdpClientProductId":0,"RdpClientVersion":"","RdpClientCapabilities":null,"Krb5MsgType":"","Krb5FailedRequest":"","Krb5ErrorCode":"","Krb5Cname":"","Krb5Realm":"","Krb5Sname":"","Krb5Encryption":"","Krb5WeakEncryption":false,"Krb5TicketEncryption":"","Krb5TicketWeakEncryption":false,"TftpPacket":"","TftpFile":"","TftpMode":"","IkeInitSpi":"","IkeRespSpi":"","IkeMessageID":0,"IkeExchangeType":0,"IkeRole":"","IkePayload":null,"IkeAlgAuth":"","IkeAlgAuthRaw":0,"IkeAlgDh":"","IkeAlgDhRaw":0,"IkeAlgEnc":"","IkeAlgEncRaw":0,"IkeAlgHash":"","IkeAlgHashRaw":0,"IkeExchangeTypeVerbose":"","IkeSaKeyLength":"","IkeSaKeyLengthRaw":0,"IkeSaLifeDuration":"","IkeSaLifeDurationRaw":0,"IkeSaLifeType":"","IkeSaLifeTypeRaw":0,"IkeVersionMajor":0,"IkeVersionMinor":0,"IkeV2Errors":0,"IkeV1Doi":0,"IkeV1EncryptedPayloads":false,"IkeV1VendorIds":null,"IkeV1ServerKeyExchangePayload":"","IkeV1ServerKeyExchangePayloadLength":0,"IkeV1ServerNoncePayload":"","IkeV1ServerNoncePayloadLength":0,"IkeV1ClientKeyExchangePayload":"","IkeV1ClientKeyExchangePayloadLength":0,"IkeV1ClientNoncePayload":"","IkeV1ClientNoncePayloadLength":0,"NfsVersion":0,"NfsProcedure":"","NfsId":0,"NfsFilename":"","NfsFileTx":false,"NfsType":"","NfsStatus":"","NfsHhash":"","NfsWriteChunks":0,"NfsWriteFirst":false,"NfsWriteLast":false,"NfsWriteLastXid":0,"NfsRenameFrom":"","NfsRenameTo":"","NfsReadChunks":0,"NfsReadFirst":false,"NfsReadLast":false,"NfsReadLastXid":0,"VerdictAction":"","VerdictReject":null,"VerdictRejectTarget":"","WebsocketFin":false,"WebsocketMask":0,"WebsocketOpcode":"","WebsocketPayloadBase64":"","WebsocketPayloadPrintable":"","TemplateRequest":"","TemplateResponse":"","EmailBodyMd5":"","EmailCarbonCopy":null,"EmailDate":"","EmailFrom":"","EmailHasExeUrl":false,"EmailHasIpv4Url":false,"EmailHasIpv6Url":false,"EmailReceived":null,"EmailStatus":"","EmailSubject":"","EmailSubjectMd5":"","EmailTo":null,"EmailUrl":null,"EmailXMailer":"","EmailAttachment":null,"EmailMessageId":"","SmtpHelo":"","SmtpMailFrom":"","SmtpRcptTo":null,"QuicVersion":"","QuicUserAgent":"","QuicServerNameIndication":"","QuicJa4":"","QuicJa3sHash":"","QuicJa3sString":"","QuicJa3Hash":"","QuicJa3String":"","DropAck":false,"DropFin":false,"DropFlowlbl":0,"DropHoplimit":0,"DropTc":0,"DropIcmpId":0,"DropIcmpSeq":0,"DropIpid":0,"DropLen":0,"DropPsh":false,"DropRst":false,"DropSyn":false,"DropTcpack":0,"DropTcpres":0,"DropTcpseq":0,"DropTcpurgp":0,"DropTcpwin":0,"DropTos":0,"DropTtl":0,"DropUdplen":0,"DropUrg":false,"DropReason":"","DropVerdictAction":"","DropVerdictReject":null,"DropVerdictRejectTarget":null,"EngineError":"","EngineErrorCode":0,"EngineMessage":"","EngineThreadName":"","EngineModule":"","PacketInfoLinktype":0,"EtherDestMac":"","EtherSrcMac":"","EtherDestMacs":null,"EtherSrcMacs":null,"FrameType":"","FrameId":0,"FrameDirection":"","FrameStreamOffset":0,"FrameLength":0,"FrameComplete":false,"FramePayload":"","FramePayloadPrintable":"","FrameTxId":0,"RpcAuthType":"","RpcStatus":"","RpcXid":0,"RpcCredsGid":0,"RpcCredsMachineName":"","RpcCredsUid":0,"NetflowStart":"","NetflowEnd":"","NetflowAge":0,"NetflowBytes":0,"NetflowMaxTTL":0,"NetflowMinTTL":0,"NetflowPkts":0,"ModbusId":0,"ModbusResponseAccessType":"","ModbusResponseCategory":"","ModbusResponseData":"","ModbusResponseErrorFlags":"","ModbusResponseFunctionCode":"","ModbusResponseFunctionRaw":0,"ModbusResponseProtocolId":0,"ModbusResponseTransactionId":0,"ModbusResponseUnitId":0,"ModbusResponseWriteAddress":0,"ModbusResponseWriteData":0,"ModbusResponseReadData":"","ModbusResponseExceptionCode":"","ModbusResponseExceptionRaw":0,"ModbusResponseDiagnosticCode":"","ModbusResponseDiagnosticData":"","ModbusResponseDiagnosticRaw":0,"ModbusRequestAccessType":"","ModbusRequestCategory":"","ModbusRequestData":"","ModbusRequestErrorFlags":"","ModbusRequestFunctionCode":"","ModbusRequestFunctionRaw":0,"ModbusRequestProtocolId":0,"ModbusRequestTransactionId":0,"ModbusRequestUnitId":0,"ModbusRequestWriteAddress":0,"ModbusRequestWriteData":0,"ModbusRequestReadAddress":0,"ModbusRequestReadQuantity":0,"ModbusRequestMeiCode":"","ModbusRequestMeiData":"","ModbusRequestMeiRaw":0,"ModbusRequestDiagnosticCode":"","ModbusRequestDiagnosticData":"","ModbusRequestDiagnosticRaw":0,"RfbScreenShared":false,"RfbServerProtocolVersionMajor":"","RfbServerProtocolVersionMinor":"","RfbClientProtocolVersionMajor":"","RfbClientProtocolVersionMinor":"","RfbFramebufferHeight":0,"RfbFramebufferName":"","RfbFramebufferWidth":0,"RfbFramebufferPixelFormatBigEndian":false,"RfbFramebufferPixelFormatBitsPerPixel":0,"RfbFramebufferPixelFormatBlueMax":0,"RfbFramebufferPixelFormatBlueShift":0,"RfbFramebufferPixelFormatDepth":0,"RfbFramebufferPixelFormatGreenMax":0,"RfbFramebufferPixelFormatGreenShift":0,"RfbFramebufferPixelFormatRedMax":0,"RfbFramebufferPixelFormatRedShift":0,"RfbFramebufferPixelFormatTrueColor":false,"RfbAuthenticationSecurityResult":"","RfbAuthenticationSecurityType":"","RfbAuthenticationVncChallenge":"","RfbAuthenticationVncResponse":"","EnipResponseCommand":"","EnipResponseStatus":"","EnipResponseCipService":"","EnipResponseCipStatus":"","EnipResponseCipStatusExtended":"","EnipResponseCipStatusExtendedMeaning":"","EnipResponseIdentityProtocolVer":0,"EnipResponseIdentityRevision":"","EnipResponseIdentityVendorId":"","EnipResponseIdentityDeviceType":"","EnipResponseIdentityProductCode":0,"EnipResponseIdentityStatus":0,"EnipResponseIdentitySerial":0,"EnipResponseIdentityProductName":"","EnipResponseIdentityState":0,"EnipResponseListServProtocolVer":0,"EnipResponseListServCapabilities":0,"EnipResponseListServServiceName":"","EnipResponseRegSessionProtoVer":0,"EnipResponseRegSessionOptions":0,"EnipRequestCommand":"","EnipRequestStatus":"","EnipRequestCipService":"","EnipRequestCipClassName":"","EnipRequestRegSessionProtoVer":0,"EnipRequestRegSessionOptions":0,"Dnp3Dst":0,"Dnp3Src":0,"Dnp3Type":"","Dnp3ResDst":0,"Dnp3ResSrc":0,"Dnp3ResType":"","Dnp3ResIINIndicators":null,"Dnp3ResControlDir":false,"Dnp3ResControlFcb":false,"Dnp3ResControlFcv":false,"Dnp3ResControlFunctionCode":0,"Dnp3ResControlPri":false,"Dnp3ResAppComplete":false,"Dnp3ResAppFunctionCode":0,"Dnp3ResAppControlCon":false,"Dnp3ResAppControlFin":false,"Dnp3ResAppControlFir":false,"Dnp3ResAppControlSequence":0,"Dnp3ResAppControlUns":false,"Dnp3ReqDst":0,"Dnp3ReqSrc":0,"Dnp3ReqType":"","Dnp3ReqControlDir":false,"Dnp3ReqControlFcb":false,"Dnp3ReqControlFcv":false,"Dnp3ReqControlFunctionCode":0,"Dnp3ReqControlPri":false,"Dnp3ReqAppComplete":false,"Dnp3ReqAppFunctionCode":0,"Dnp3ReqAppControlCon":false,"Dnp3ReqAppControlFin":false,"Dnp3ReqAppControlFir":false,"Dnp3ReqAppControlSequence":0,"Dnp3ReqAppControlUns":false,"Dnp3IINIndicators":null,"Dnp3ControlDir":false,"Dnp3ControlFcb":false,"Dnp3ControlFcv":false,"Dnp3ControlFunctionCode":0,"Dnp3ControlPri":false,"Dnp3AppComplete":false,"Dnp3AppFunctionCode":0,"Dnp3AppControlCon":false,"Dnp3AppControlFin":false,"Dnp3AppControlFir":false,"Dnp3AppControlSequence":0,"Dnp3AppControlUns":false,"PgSQLTxId":"","PgSQLResAuthmd5Password":"","PgSQLResAuthSaslFinal":"","PgSQLResCode":"","PgSQLResComCompleted":"","PgSQLResDataRows":0,"PgSQLResDataSize":0,"PgSQLResFieldCount":0,"PgSQLResFile":"","PgSQLResLine":"","PgSQLResMessage":"","PgSQLResProcessId":0,"PgSQLResRoutine":"","PgSQLResSecretKey":0,"PgSQLResSeverityLocalizable":"","PgSQLResSeverityNonLocalizable":"","PgSQLResSslAccepted":false,"PgSQLReqMessage":"","PgSQLReqPassword":"","PgSQLReqPasswordMessage":"","PgSQLReqProcessId":0,"PgSQLReqProtoVersion":"","PgSQLReqSaslAuthMechanism":"","PgSQLReqSaslParam":"","PgSQLReqSaslResp":"","PgSQLReqSecretKey":0,"PgSQLReqSimpleQuery":"","PgSQLReqStartupParamsUser":"","BittorrentDhtTransactionId":"","BittorrentDhtClientVer":"","BittorrentDhtReqType":"","BittorrentDhtErrorNum":0,"BittorrentDhtErrorMsg":"","BittorrentDhtResId":"","BittorrentDhtResToken":"","BittorrentDhtReqId":"","BittorrentDhtReqTarget":"","BittorrentDhtReqImpliedPort":0,"BittorrentDhtReqInfoHash":"","BittorrentDhtReqPort":0,"BittorrentDhtReqToken":"","MqttUnsubscribeDup":false,"MqttUnsubscribeMesId":0,"MqttUnsubscribeQos":0,"MqttUnsubscribeRetain":false,"MqttUnsubscribeTopics":null,"MqttUnsubackDup":false,"MqttUnsubackMesId":0,"MqttUnsubackQos":0,"MqttUnsubackRetain":false,"MqttUnsubackReasonCod":null,"MqttSubscribeDup":false,"MqttSubscribeMesId":0,"MqttSubscribeQos":0,"MqttSubscribeRetain":false,"MqttSubackDup":false,"MqttSubackMesId":0,"MqttSubackQos":0,"MqttSubackRetain":false,"MqttSubackQosGranted":null,"MqttPubrelDup":false,"MqttPubrelMesId":0,"MqttPubrelQos":0,"MqttPubrelReasonCode":0,"MqttPubrelRetain":false,"MqttPubrecDup":false,"MqttPubrecMesId":0,"MqttPubrecQos":0,"MqttPubrecReasonCode":0,"MqttPubrecRetain":false,"MqttPublishDup":false,"MqttPublishMessage":"","MqttPublishMesId":0,"MqttPublishQos":0,"MqttPublishRetain":false,"MqttPublishSkippedLength":0,"MqttPublishTopic":"","MqttPublishTruncated":false,"MqttPubcompDup":false,"MqttPubcompMesId":0,"MqttPubcompQos":0,"MqttPubcompReasonCode":0,"MqttPubcompRetain":false,"MqttPubackDup":false,"MqttPubackMesId":0,"MqttPubackQos":0,"MqttPubackReasonCode":0,"MqttPubackRetain":false,"MqttPingrespDup":false,"MqttPingrespQos":0,"MqttPingrespRetain":false,"MqttPingreqDup":false,"MqttPingreqQos":0,"MqttPingreqRetain":false,"MqttDisconnectDup":false,"MqttDisconnectQos":0,"MqttDisconnectReasonCode":0,"MqttDisconnectRetain":false,"MqttConnectClientId":"","MqttConnectDup":false,"MqttConnectPassword":"","MqttConnectProtocolString":"","MqttConnectProtocolVersion":0,"MqttConnectQos":0,"MqttConnectRetain":false,"MqttConnectUsername":"","MqttConnectWillMessage":"","MqttConnectWillTopic":"","MqttConnectFlagCleanSession":false,"MqttConnectFlagPassword":false,"MqttConnectFlagUsername":false,"MqttConnectFlagWill":false,"MqttConnectFlagWillRetain":false,"MqttConnackDup":false,"MqttConnackQos":0,"MqttConnackRetain":false,"MqttConnackReturnCode":0,"MqttConnackSessionPresent":false,"LdapReqOperation":"","LdapReqMesId":0,"LdapReqExtendedName":"","LdapReqExtendedValue":"","LdapReqAbandonMesId":0,"LdapReqCompareEntry":"","LdapReqCompareAttrValueDescr":"","LdapReqCompareAttrValue":"","LdapReqModDnEntry":"","LdapReqModDnNewRdn":"","LdapReqModDnDeleteOldRdn":false,"LdapReqModDnNewSuperior":"","LdapReqDelDn":"","LdapReqAddEntry":"","LdapReqModifyObject":"","LdapReqBindVersion":0,"LdapReqBindName":"","LdapReqBindSaslMechanism":"","LdapReqBindSaslCredentials":"","LdapReqSearchBaseObj":"","LdapReqSearchScope":0,"LdapReqSearchDerefAlias":0,"LdapReqSearchSizeLim":0,"LdapReqSearchTimeLim":0,"LdapReqSearchTypesOnline":false,"LdapReqSearchAttr":null,"MetadataFlowbits":null,"LogType":"net_activity","UUID":"1de3be0a-ef64-4e93-9d41-63ceb2278984"}

the event is not decoded

Does Wazuh have a limit on event size?

[Marcos Sanchez Delgado]

Hello.

There is indeed a limit on the event size, but it’s not the limit that’s causing your issue. The limit causing your issue is the limit on decoded fields, which defaults to 256 (`analysisd.decoder_order_size=256`)(link to the documentation). You can check this in the `/var/ossec/etc/internal_options.conf` file. Your event contains many empty fields that are also being decoded, causing the limit to be reached.

To fix this, you have two options. The first is to increase the limit in the internal configuration file I mentioned earlier (which temporarily solves the problem but increases computational overhead). The second is to have the source that generates your events remove empty fields before Wazuh processes them. That way, you wouldn’t have to increase the limit, and processing would be cleaner. As a reminder, keep in mind that you can test your decoders using the wazuh-logtest tool.