Hello.
I have problems with logs that having field message even 10 millions characters long. I will be removed from logs in future. But for now I'm getting shard fail error. The solution is setting max_analyzed_offset limit - but documentation refers to using that in Dev Tools. Where I can put max_analyzed_offset limit as an option so it will be limiting fields to lets say 1 000 000 characters and not showing the rest. I need it in Kibana > Discovery. Any ideas ?
Hi @elk1985,
In Kibana UI there is an option to define data view field filters to exclude unwanted fields (via Data View Management page). And you can define a runtime field with a custom logic for truncation. Then you would be able to preview this runtime field in Discover.