# Finding documents with message field exceeding 1 mln characters

**URL:** <https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [February 21, 2024, 12:02pm UTC](https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788 "2024-02-21T12:02:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![elk1985](https://avatars.discourse-cdn.com/v4/letter/e/58956e/32.png) [@elk1985](https://discuss.elastic.co/u/elk1985)\
**Post date:** [February 21, 2024, 12:02pm UTC](https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788/1 "2024-02-21T12:02:06Z")

</div>

Hello.  
I'm getting error regarding exceeded message field length (over 1 mln characters).  
I want to identify them. I found a script in painless language:

```auto
GET /your_index/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "script": {
            "script": {
              "source": "doc['message.keyword'].value.length() > 1000000",
              "lang": "painless"
            }
          }
        }
      ]
    }
  }
}

```

I'm getting

```auto
Unhandled Exception illegal_argument_exception

unexpected token ['{'] was expecting one of [{<EOF>, ';'}].

Stack:
[
  "GET /your_index/_search\n{\n \"query\": {\n \"bool\" ...",
  " ^---- HERE"
]

```

What's wrong here. Any ideas ?

---

<div class="post-metadata">

**Author:** ![elk1985](https://avatars.discourse-cdn.com/v4/letter/e/58956e/32.png) [@elk1985](https://discuss.elastic.co/u/elk1985)\
**Post date:** [February 26, 2024, 9:21am UTC](https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788/2 "2024-02-26T09:21:30Z")

</div>

Hey. I have problems with this script - it will probably won't work.  
I have question regarding Mapper size plugin. If I will install it now will I be able to search for large documents in indexes from past (4 months back) ?

[Maper size plugin](https://www.elastic.co/guide/en/elasticsearch/plugins/current/mapper-size.html)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 26, 2024, 11:43am UTC](https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788/3 "2024-02-26T11:43:21Z")

</div>

No. It works only on updated or new documents.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 26, 2024, 11:44am UTC](https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788/4 "2024-02-26T11:44:24Z")

</div>

From where are you running this?

---

<div class="post-metadata">

**Author:** ![elk1985](https://avatars.discourse-cdn.com/v4/letter/e/58956e/32.png) [@elk1985](https://discuss.elastic.co/u/elk1985)\
**Post date:** [February 27, 2024, 8:47am UTC](https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788/5 "2024-02-27T08:47:17Z")

</div>

I was running it from Dev Tools. I was able to fix the script. But it was not working on text fields. So instead i used Size mapper plugin. It works like a charm.  
And You are correct - plugin works only after You enable it in template or in new index.  
Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2024, 8:48am UTC](https://discuss.elastic.co/t/finding-documents-with-message-field-exceeding-1-mln-characters/353788/6 "2024-03-26T08:48:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.