Error "event exceeds maximum size: event at offset 1 is larger than xx Bytes" on Panther AWS Config History log source
When trying to ingest my AWS Config History Logs, I get the error
"event exceeds maximum size: event at offset 1 is larger than 15728640 Bytes" on my Log Source.
To resolve this issue set a prefix to exclude the Config History context, which will reduce the ingested file size.
Based on the default format of the AWS Config History Log:
An exclusion pattern such as
*_Config_*ConfigHistory*.json.gz could be applied.
Due to their content, the AWS Config History Logs are usually large files. This issue occurs because the AWS Config history Logs' uncompressed size exceeds Panther's maximum allowed limit size.