Logstash根据字节截取超长字段，并新增原字符串的字节大小

if [responseBody] {
   ruby {
      code => 'event.set("responseBodySize", event.get("responseBody").bytesize)'
   }
   # 这将截断字节值，而不是字符数,一个中文对应三个字节
   truncate {
      fields => "responseBody"
      length_bytes => 1024
   }
}

参考文档 https://www.elastic.co/guide/en/logstash/current/event-api.html https://www.educative.io/answers/how-to-get-the-size-of-a-string-in-bytes-in-ruby https://www.elastic.co/guide/en/logstash/current/plugins-filters-truncate.html