Field has exceeded the allowed maximum of [1000000] set for the next major Elastic version

Elastic Stack Elasticsearch
1

Hello,

I use Elasticsearch and Logstash 6.5.4 for storing log data. One application also stores Requests/Responses from webservices. To store those fields I have created a custom mapping, part of it:

{
  "mapping": {
    "doc": {
      "_source": {
        "enabled": false
      },
      "properties": {
        "REQUEST": {
          "type": "text",
          "index": false,
          "store": true
        },
        "RESPONSE": {
          "type": "text",
          "index": false,
          "store": true
        }
      }
    }
  }
}

Despite this mapping I get the following error:
The length [1209411] of [RESPONSE] field of [yY6Vt2gBZA-Jyqcm6hu3] doc of [XXX-2019.02.04] index has exceeded the allowed maximum of [1000000] set for the next major Elastic version. This maximum can be set by changing the [index.highlight.max_analyzed_offset] index level setting. For large texts, indexing with offsets or term vectors is recommended!

I am confused by this message as I have disabled indexing for this field and it should only be stored. Can anyone explain to me why I get this error?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.