My guess would be that you're exceeding the message field after merging the events together.  The message field has a limit of 1023 and if you exceed that limit (or limits of any fields for that matter), you'll see the denial of service messages you're seeing.  The deviceCustomString fields have higher limits (4000), so it's possible you could try to use those and then clear after parsing.  

Thanks, this worked, but only for the events presented in the discussion above. However, my connector uses two extra processors because the events have two types of structures. I replaced event.message with deviceCustomString1 and enabled clearfieldafterparsing=true, but the structure, which is much larger, stopped sending data to the console, that is, I get information in the fields only from smaller events. If I leave true only for the first extra processor, and make it false for the second one, the situation does not change - the events arrive, but the information in the fields is displayed only for those that are smaller, as in the example.

I modified my config file and everything seemed to be fine, but my previous problem is still present and this time with a field that is unused. I don't understand. How this works?

New file:

# CEF Parser Configuration File

replace.defaults=true
trim.tokens=true
comments.start.with=#

multiline.starts.regex=(\\w{3} \\d{2} \\d{2}:\\d{2}:\\d{2})\\s(\\S+)\\s(\\S+\\[\\d+\\]):[\\s\\S]*?CN=([^,]+).*
multiline.ends.regex=->\\s.*
regex=(\\w{3} \\d{2} \\d{2}:\\d{2}:\\d{2})\\s(\\S+)\\s(\\S+\\[\\d+\\])[\\s\\S]*?(\\d.+):(\\d+)[\\s\\S]*?CN=([^,]+),\\sO=([^,]+),\\sOU=([^,]+),\\stitle=([^,]+),\\sL=([^,]+),\\sST=([^,]+),\\sstreet=([^,]+(?:,\\s[^,]+)?)[\\s\\S]*Learn:\\s([^\\s]+).*

token.count=13

token[0].name=Date
token[0].type=TimeStamp
token[0].format=MMM dd HH:mm:ss

token[1].name=HostName
token[1].type=String

token[2].name=ServiceId
token[2].type=String

token[3].name=SourceAddress
token[3].type=IPAddress

token[4].name=SourcePort
token[4].type=Integer

token[5].name=CN
token[5].type=String

token[6].name=O
token[6].type=String

token[7].name=OU
token[7].type=String

token[8].name=Title
token[8].type=String

token[9].name=L
token[9].type=String

token[10].name=ST
token[10].type=String

token[11].name=Street
token[11].type=String

token[12].name=Destination
token[12].type=IPAddress

additionaldata.enabled=false

event.deviceVendor=__stringConstant(Finally)
event.deviceProduct=__stringConstant(Finally)
event.endTime=Date
event.deviceHostName=HostName
event.deviceCustomString1=ServiceId
event.sourceAddress=SourceAddress
event.sourcePort=SourcePort
event.deviceCustomString2=CN
event.deviceCustomString3=O
event.deviceCustomString4=OU
event.deviceCustomString5=Title
event.deviceCustomString6=L
event.flexString1=ST
event.flexString2=Street
event.deviceAddress=Destination

Problem in console:

What is this rawEvent field?

If you've set preserve raw event on the connector then it would save the original event to the raw event field.  That has a limit of 4000 characters, just like the deviceCustomString fields.  If you end up with values beyond 4000, that's when you'll see the truncate messages.  Likely when the event merging is happening, it's going beyond 4000 characters which is why you're seeing these messages.  

Okay, can I disable this saving right now or is it only done during the installation and configuration of the connector?

I found that function was disable by default, but still have a problem. If it's not a problem and can't be fixed, can I just ignore it? Or I can simply increase the maximum size of the rawEvent field in agent.default.properties file. Is this a good idea and won't it lead to even bigger problems?

Increasing the size of rawEvent could end up causing problems downstream if the larger value gets passed.  ESM will also have a limit of 4000 on that, so it will have to deal will either truncating or dropping the large event values.  It would be up to you to evaluate if you feel you're missing valuable information on the truncated events, to determine how you might want to handle this.  

Although I get a denial of service notification, all the necessary data from the event comes through without issue. I don't really need to remove this notification, I just wanted to understand how it works because I get the data I need (it is structured so that 90% of the information I need is at the beginning of the event and 10% of the information is at the end of the event). I wonder how ArcSight provides the rest of the information if the event was shortened.