Context length is bigger than maximum allowed string

[Ankita_Pachauri]

Hi Team,

We are trying to fetch log events on the discover tab and getting the following error. The log events consists of large Java stacks.

We are using ELK version 8.10.

I tried updating the server.maxPayload to 11057591792, however doing this does not resolve the issue. The server has 16GB of RAM, out of which 12GB is assigned to Kibana.

Can someone please help me with a solution to this problem?

//Ankita

[jessgarson]

Thanks for reaching out, @Ankita_Pachauri; there was a similar post that might be a good starting point for resolving this issue.

Best,

Jessica

[Ankita_Pachauri]

Hi Jess,
Project requirement is such that we cannot truncate the logs. Can you please support with some alternative options?

//Ankita

[jessgarson]

Thanks for following up. A workaround was suggested for a GitHub issue on this topic. You could try adding impacted fields to the "Field filter" from Stack Management > Index Patterns > "broker-server*" page ("Field filters" tab), so Discover doesn't request them. Would something like this work?

I'm interested in learning more about your dataset. Do you have an example of the large Java stack you can share?

Thanks again!