# Elasticsearch setting field index limit

**URL:** <https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675>\
**Category:** Elasticsearch\
**Created:** [May 14, 2018, 7:31am UTC](https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675 "2018-05-14T07:31:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dhivya\_Buvanesh](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Dhivya\_Buvanesh](https://discuss.elastic.co/u/Dhivya_Buvanesh)\
**Post date:** [May 14, 2018, 7:31am UTC](https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675/1 "2018-05-14T07:31:49Z")

</div>

hi  
How to make the default elastic search field limit setting as more than 1000, for any or all index  
Tried adding the below line in elasticsearch.yml - but elastic search was unable to start, hope this is not the right way.  
index.mapping.total\_fields.limit: 60000

Can anyone pls suggest how to go about this ? , when trying to upload via logtash/filebeat or bulk upload we get this error and some data gets missed to upload.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 14, 2018, 7:39am UTC](https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675/2 "2018-05-14T07:39:54Z")

</div>

You can set this through an [index template](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/indices-templates.html). That does however seem like an awfully large value. Given that the default value is there for a reason, increasing it that much might cause problems, especially if it is applied to a large number of indices. Why do you need to set it so large?

---

<div class="post-metadata">

**Author:** ![Dhivya\_Buvanesh](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Dhivya\_Buvanesh](https://discuss.elastic.co/u/Dhivya_Buvanesh)\
**Post date:** [May 14, 2018, 8:29am UTC](https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675/3 "2018-05-14T08:29:03Z")

</div>

thank you, Is there an option without template - to make it default for any upload in elastic?  
[https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana](https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana)

My use case is to analyse the network packet by storing it in elastic- similar to above link, to but I am grouping them with index based on filename, So creating multiple template for each for each file does not seem feasible.

Now I am using logtash to upload, Is there way to specify the index field limit in logtash.conf , if default global elastic setting is not possible ?

**current logtash.conf:**

input {  
file {  
path =\> "C:/logtash/\*"  
start\_position =\> "beginning"  
}  
}  
filter {  
# Drop Elasticsearch Bulk API control lines  
if ([message] =~ "{"index") {  
drop {}  
}

```
json {
    source => "message"
    remove_field => "message"
}
grok { match => ["path", "/(?<filename>[^/]+).json" ] } 

```

}  
output {  
elasticsearch {  
hosts =\> "localhost:9200"  
document\_type =\> "pcap\_file"  
index =\> "%{filename}"  
manage\_template =\> false  
}  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 14, 2018, 9:00am UTC](https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675/4 "2018-05-14T09:00:17Z")

</div>

You can create a template that matches any index name pattern.

---

<div class="post-metadata">

**Author:** ![Dhivya\_Buvanesh](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@Dhivya\_Buvanesh](https://discuss.elastic.co/u/Dhivya_Buvanesh)\
**Post date:** [May 15, 2018, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675/5 "2018-05-15T12:22:47Z")

</div>

Thank you, template helped to resolve this

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2018, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-setting-field-index-limit/131675/6 "2018-06-12T12:22:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.