Crowdstream - Bytes out size doubled

A sample of the original event, and the resulting event(s) would help a lot. My best guess without any samples is that your unroll is keep bits of the original event in each and every resulting "unrolled" event.

Hi Jon,

Thanks for the response, As we couldnt capture sample input and output log. attached the random log files

Can you share the pipeline(s)?

created 1 Pipeline with function unroll and attached it to source pre-processing.

Please find attached screenshot for reference.

I'm not clear why you're seeing this behavior, but try adding an Eval function before the Unroll. In the Eval, drop the __raw field. That's a double underscore raw. Let me know if that helps.

Edit: I've confirmed internally that __raw is included in the internal metrics and volume accounting. Use the Eval mentioned above to remove it to avoid this mistake. I'll raise a ticket to for the product team to look into this.

HI Jon,

Do you have multiple outputs? If you're sending data to more than one destination, your output will be appropriately higher. What does the preview screen's inspection show you? (The bar chart icon at the top of the preview pane)

Hard to tell from these screenshots, but I don't see anything obvious. I'd open a support ticket: support@cribl.io