Finding documents with message field exceeding 1 mln characters

Elastic Stack Elasticsearch
1

Hello.
I'm getting error regarding exceeded message field length (over 1 mln characters).
I want to identify them. I found a script in painless language:

GET /your_index/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "script": {
            "script": {
              "source": "doc['message.keyword'].value.length() > 1000000",
              "lang": "painless"
            }
          }
        }
      ]
    }
  }
}

I'm getting

Unhandled Exception illegal_argument_exception

unexpected token ['{'] was expecting one of [{<EOF>, ';'}].

Stack:
[
  "GET /your_index/_search\n{\n  \"query\": {\n    \"bool\" ...",
  "                        ^---- HERE"
]

What's wrong here. Any ideas ?

2

Hey. I have problems with this script - it will probably won't work.
I have question regarding Mapper size plugin. If I will install it now will I be able to search for large documents in indexes from past (4 months back) ?

Maper size plugin

3

No. It works only on updated or new documents.

4

From where are you running this?

5

I was running it from Dev Tools. I was able to fix the script. But it was not working on text fields. So instead i used Size mapper plugin. It works like a charm.
And You are correct - plugin works only after You enable it in template or in new index.
Regards