# max_scan_bytes

Maximum number of bytes to scan when searching for JSON content in find-json mode.

This parameter applies to JSON Structured Content Extraction Module (mmjsonparse).

Name:

  max_scan_bytes

Scope:

  action

Type:

  positive integer

Default:

  65536

Required?:

  no

Introduced:

  8.2506.0

## Description

Sets the maximum number of bytes to scan when searching for JSON objects in find-json mode. This prevents performance issues with very large messages by limiting the amount of data that will be examined.

When the scan limit is reached without finding a complete JSON object, the message is treated as non-JSON and processed through the fallback path (creating a simple JSON object with the original message as the “msg” field).

This parameter is only effective when mode=”find-json”.

## Input usage

    # Scan up to 32KB for JSON content
    action(type="mmjsonparse" mode="find-json" max_scan_bytes="32768")

    # Use default 64KB scan limit
    action(type="mmjsonparse" mode="find-json")

## See also

See also the main mmjsonparse module documentation.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.