# Elasticsearch Index Mapping Exceeded **URL:** \ **Category:** Elasticsearch\ **Created:** [June 19, 2019, 8:11pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537 "2019-06-19T20:11:46Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 19, 2019, 8:11pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/1 "2019-06-19T20:11:46Z")
Hello there, As the title suggests, our index mapping has exceeded 1,000. What happens to the logs that introduce new fields? Are they not recorded or are the 1,001+ fields just not usable at this time? It's looking like we need about 2,500 fields, but we may split up the index into multiple indices instead. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 19, 2019, 8:26pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/2 "2019-06-19T20:26:13Z")
They will be rejected as the mapping can not be updated. You can also increase this limit but it's better probably to check if you really need so many fields or to split into multiple indices. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 19, 2019, 8:42pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/3 "2019-06-19T20:42:30Z")
By rejected, do you mean they will not be stored in Elasticsearch at all? Currently, the index mapping shows there are 2,200 fields. I figured the fields would stay in a ! state and not usable until the index mapping was fixed. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 19, 2019, 8:54pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/4 "2019-06-19T20:54:09Z")
Which version? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 19, 2019, 8:54pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/5 "2019-06-19T20:54:29Z")
We are on 7.1 ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 19, 2019, 8:56pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/6 "2019-06-19T20:56:17Z")
I believe that documents should be rejected. That's how I read [https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html#mapping-limit-settings) @jpountz will know much better than me. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 19, 2019, 9:00pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/7 "2019-06-19T21:00:30Z")
But ES has error logs saying failed to execute bulk item..... limit of total fields 1000 in index X has been exceeded. Yeah I saw that in the documentation. I just wanted clarification that "rejected" mean the data was not stored in ES or if it is stored, but those extra fields are not usable. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 19, 2019, 9:16pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/8 "2019-06-19T21:16:48Z")
Bulk rejection means that the document is not stored. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 20, 2019, 5:15pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/9 "2019-06-20T17:15:34Z")
Well we increased the field limit to 3,000, but that isn't enough. These logs are specific to all windows logs: System, Application, and Security. Does anyone know the total number of fields possible for all windows events? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 20, 2019, 5:28pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/10 "2019-06-20T17:28:39Z")
What does a typical document is looking like? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 20, 2019, 5:59pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/11 "2019-06-20T17:59:45Z")
Well we are shipping windows logs directly from the windows servers. We using Nxlog to send all 3 log types and all severities. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 20, 2019, 6:46pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/12 "2019-06-20T18:46:12Z")
Ok. And what does a typical document is looking like? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 20, 2019, 6:52pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/13 "2019-06-20T18:52:03Z")
They all look like this for the most part. Some have more fields than others since we have this issue going on, but I imagine there are probably 100k or more total windows event. I need something to pitch to the boss that says we can't log this for various reasons. ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0f120f61252209728b6b569abd0d1d8ce36ee58b.png) ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 20, 2019, 8:05pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/14 "2019-06-20T20:05:46Z")
Please don't post images of text as they are hardly readable and not searchable. Instead paste the text and format it with `` icon. Check the preview window. Could you share a full document? It can be on [gist.github.com](http://gist.github.com) if too big for this forum. Thanks. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 20, 2019, 9:10pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/15 "2019-06-20T21:10:28Z")
``` Authentication Package Negotiate t Caller Domain domain t Caller Logon ID (0x0,0x3E7) t Caller Process ID 444 t Caller User Name dc$ t Domain domain t Logon GUID - t Logon ID (0x0,0x93FD2C08) t Logon Process Advapi t Logon Type 3 t Source Network Address 1.1.1.1 t Source Port 37076 t Transited Services - t User Name cssclient t Workstation Name dc @timestamp June 20th 2019, 14:47:35.941 t@version 1 tAccountName test tAccountType User tCategory Logon/Logoff #CategoryNumber 2 tDomain domain #EventID 540 tEventReceivedTime 2019-06-20 14:47:36 tEventTime 2019-06-20 14:47:35 tEventTimeWritten 2019-06-20 14:47:35 tEventType AUDIT_SUCCESS tFileName Security tHostname dc #RecordNumber -1,452,110,094 tSeverity INFO #SeverityValue 2 tSourceModuleName in tSourceModuleType im_mseventlog tSourceName Security t_id AWt2Ny8C7-UxPwC7EoPl t_index logstash-2019.06.20 #_score t_type corp_windows_events thost 1.1.1.1 #port 1,070 ttags Low ttype corp_windows_events ``` This is a whole log. I'm really just wanting to know if someone knows how many total fields there are for all the windows events. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 21, 2019, 3:47am UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/16 "2019-06-21T03:47:55Z")
Wondering why you didn't show a json document (ie the result of a `GET index/_doc/id`. Anyway here you have very few fields so I don't understand where the 3000 fields are coming from. So what is the current mapping you have? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 21, 2019, 1:05pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/17 "2019-06-21T13:05:26Z")
That's why I am saying that posting a sample log isn't going to help lol We're are currently logging ALL Windows event types and severity: Application, System, Security with Info, Warming, Verbose, Critical, etc. I'm just wanting to know if anyone knows how many fields I should be expecting from logging this many events; if someone ran into this similar issue? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 21, 2019, 5:13pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/18 "2019-06-21T17:13:08Z")
Didn't you say that when you increase the limit to 3000 you are seeing rejected documents? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [June 21, 2019, 5:34pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/19 "2019-06-21T17:34:21Z")
Yeah because the count is still over 3,000 😃 probably because of the insane variety of log types. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 21, 2019, 7:18pm UTC](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537/20 "2019-06-21T19:18:43Z")
So what is the mapping? [Next page](https://discuss.elastic.co/t/elasticsearch-index-mapping-exceeded/186537.md?page=2)