Hello.
I have problems with logs that having field message even 10 millions characters long. I will be removed from logs in future. But for now I'm getting shard fail error. The solution is setting max_analyzed_offset limit - but documentation refers to using that in Dev Tools. Where I can put max_analyzed_offset limit as an option so it will be limiting fields to lets say 1 000 000 characters and not showing the rest. I need it in Kibana > Discovery. Any ideas ?
Hi @elk1985,
In Kibana UI there is an option to define data view field filters to exclude unwanted fields (via Data View Management page). And you can define a runtime field with a custom logic for truncation. Then you would be able to preview this runtime field in Discover.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.