We’re running into an issue where one of our analysts put a query into a query pack that generated massive amounts of data (think: process table snapshot every 60s), while remotely logging over TLS. The TLS logger enforces a maximum upload size by default of something like 1024 records — obviously way fewer than were getting generated.