Error when attempting to create component template using the ECS generator

[bvoros (Bertalan Voros)]

Hello all,

I am using the ECS mapping template generator to create the relevant components so we can start using the ECS fields. I cloned GitHub - elastic/ecs: Elastic Common Schema and generated essentially the default v8.8.0 json files to create the component templates and and the relevant mapping template.

When creating each component template, they all get successfully created apart form one of them that results in the following error message.

ecs_8.8.0_process
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Limit of total fields [1000] has been exceeded"}],"type":"illegal_argument_exception","reason":"Limit of total fields [1000] has been exceeded"},"status":400}

Does this make sense to you?
What am I doing wrong?

My elasticsearch version is 8.8.0.

Thanks in advance,
BV

[xeraa]

It's a soft-limit and you can change it through index.mapping.total_fields.limit on the index. It's there to prevent you from (expensive) mistakes but there are scenarios where you need it; increasing the limit isn't an uncommon thing but I'd keep it to something reasonable like 2K or so.

PS: Are you creating an index with all of these fields or datastreams where you'd split them up?