Error filebeat - Trying to retrieve too many docvalue_fields

[Maria_Gabriela_Perez (Maria Gabriela Perez Urdaneta)]

[illegal_argument_exception] Trying to retrieve too many docvalue_fields. Must be less than or equal to: [200] but was [208]. This limit can be set by changing the [index.max_docvalue_fields_search] index level setting.

[stephenb (Stephen Brown)]

Hi @Maria_Gabriela_Perez

You are going to need to provide a lot more detail if you would like help.

What version of the stack are you on?

What are you doing when you see this?

Where do you see this error? In the filebeat logs, In Kibana?

Did you look at this

Kibana requesting too many doc values

Hi CJ, thanks for asking the team. I ended up bumping max_docvalue_fields_search for now and that has worked out. I think mapping them to strings is the next best option, and that's what I'll probably do when the next time this comes up. I really wanted to avoid having to create mappings manually though, since the schema is pretty arbitrary. As for using a single index pattern, I do usually want my query to hit all indexes in Kibana. The events are usually for the same domain object, but withi…