Alert payload with multiple JSON keys

Hi Team,
I am trying to forward multiple json keys from the generated alert. However after adding few keys in the FACET i see the showing error:


My Query:
SELECT count(*) FROM Log WHERE status_code = 500 FACET url,request_headers.x-real-ip,method,request_headers.x-real-ip,request_headers.x-forwarded-for,request_headers.user-agent,hostname,traceback,,user_information.family_name,user_information.given_name,,body.code,body.sources,,body.query,,,body.address.location,body.username,body

Hello @tech393.

Thank you for reaching out and welcome to the community!

We appreciate you posting your query along with the error you are receiving. I am going to loop in one of our fantastic support engineers to assist further. They will reply to this post when available. Please reach out with any other questions you may have, we are happy to help!

Hello! Faceted queries can return a maximum of 5000 values for static and anomaly conditions.

Also, check the syntax on your query. I had better luck with putting backticks on the attributes:
SELECT count(*) FROM Log WHERE status_code = 500 facet request_headers.x-tool-name, request_headers.x-real-ip since 5 hours ago