> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-can-i-adjust-the-character-length-of-log-fields-in-the-enginsight-siem.md).

# How can I adjust the character length of log fields in the Enginsight SIEM?

In the Enginsight SIEM, log fields are truncated after 256 characters (UTF-16) by default. This affects both how a log field is shown in the user interface of the Enginsight platform and how it is processed, for example in workflows. Full-text search is not affected and always searches the complete content of a log field.

You can adjust the character length of a log field in the configuration file of the Enginsight Loggernaut component, either for all organizations or separately for each organization you manage.

Follow these steps:

{% stepper %}
{% step %}

### Open the Loggernaut configuration file

1. Log in to the **SIEM Management Server** or the dedicated server on which you installed the Enginsight SIEM component Loggernaut.
2. Open the **Loggernaut configuration file** using the following command:

```
sudo nano /opt/enginsight/loggernaut/config.json
```

{% endstep %}

{% step %}

### Add the `maxChars` section

In the configuration file, add the `maxChars` section for [all organizations](#adjustment-for-all-organizations), for [individual organizations](#adjustment-for-individual-organizations), or for [all organizations with exceptions for individual organizations](#adjustment-for-all-organizations-with-exceptions-for-individual-organizations).

Replace the placeholders in `<>` as follows:

<table><thead><tr><th width="199.8828125">Placeholder</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;FieldName></code></td><td>The name of the log field, for example <code>winlog.EventData.TaskContent</code></td></tr><tr><td><code>&#x3C;CharacterLength></code></td><td><p>The required number of characters (UTF-16) as an integer, for example <code>1024</code>.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: The maximum size of 32,766 bytes must not be exceeded.</p></div></td></tr><tr><td><code>&#x3C;OrganizationID></code></td><td>The ID of the organization for which the specified character length of the respective log field should apply.</td></tr></tbody></table>

#### Adjustment for all organizations

```
"maxChars": {
    "*": {
        "<FieldName1>": <CharacterLength>,
        "<FieldName2>": <CharacterLength>
    }
}
```

#### Adjustment for individual organizations

```
"maxChars": {
    "<OrganizationID1>": {
        "<FieldName1>": <CharacterLength>,
        "<FieldName2>": <CharacterLength>
    },
    "<OrganizationID2>": {
        "<FieldName1>": <CharacterLength>,
        "<FieldName2>": <CharacterLength>
    }
}
```

#### Adjustment for all organizations with exceptions for individual organizations

{% hint style="warning" %}
**Please note**: Settings for individual organizations always override the setting for all organizations.
{% endhint %}

```
"maxChars": {
    "*": {
        "<FieldName1>": <CharacterLength>,
        "<FieldName2>": <CharacterLength>
    },
    "<OrganizationID1>": {
        "<FieldName1>": <CharacterLength>,
        "<FieldName2>": <CharacterLength>
    },
    "<OrganizationID2>": {
        "<FieldName1>": <CharacterLength>,
        "<FieldName2>": <CharacterLength>
    }
}
```

{% endstep %}

{% step %}

### Save the configuration changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Restart Loggernaut

Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}
{% endstepper %}

***