Field mapping: "ignore_above" and "index" settings

Elastic Stack Elasticsearch
1

I experienced bulks by logstash returning some errors,

The template contained this mapping for event.original field:
{"index": false, "type": "keyword", "doc_values": false }

The unexpected solution has been the introduction of "ignore_above" as below:
{"ignore_above": 1024,"index": false, "type": "keyword", "doc_values": false }

This seems very strange to me because I expected that the clause <"index": false> was enough to avoid indexing the values of this field (as explaned under index | Elasticsearch Guide [8.4] | Elastic).

Am I wrong supposing that "index": false should be enough?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.