Hi Experts,
I'm parsing my source logs then meeting an issue such like this:
[2019-09-05T15:56:34,215][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"lsh_nokia_nokiasbc-2019.09.05", :_type=>"_doc", :_routing=>nil}, #LogStash::Event:0x734643a0], :response=>{"index"=>{"_index"=>"lsh_nokia_nokiasbc-2019.09.05", "_type"=>"_doc", "_id"=>"XqRsAG0Bb-u0KskwxgGb", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Limit of total fields [1000] in index [lsh_nokia_nokiasbc-2019.09.05] has been exceeded"}}}}
I have search the similar issues that the solution point we need modify the value of total_fields.
I have also check the currently value of it from my elasticsearch index:
It is 1000 but i can't modify by using kibana GUI.
I have tried to use curl to execute elasticsearch console command to modify it, I execute a lot of methods which showed as below, but all of them are returned failed.
[admin@HPG5L3 ~]$ curl -XPUT localhost:9200/_template/lsh_nokia_nokiasbc-2019.09 .05 -d ' { "settings" : { "index.mapping.total_fields.limit" : "2000" } }'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not support [admin@HPG5L3 ~]$ curl -XPUT localhost:9200/_template/lsh_nokia_nokiasbc-2019.09.05 -d ' { "settings" : { "index.mapping.total_fields.limit" : "2000" } }'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$ curl -XPUT localhost:9200/_template/lsh_nokia_nokiasbc-2019.09.05 -d ' { "default" : { "total_fields.limit" : "3000" } }'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$ curl -XPUT localhost:9200/_template/lsh_nokia_nokiasbc-2019.09.05 -d ' { "settings" : { "total_fields.limit" : "3000" } }'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$ curl -XPUT localhost:9200/_template/lsh_nokia_nokiasbc-2019.09.05 -d '{
"order" : 1,
"index_patterns": ["lsh_nokia_nokiasbc-2019.09*"],
"settings" : {
"index.mapping.total_fields.limit": 3000,
}
}'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}[admin@HPG5L3 ~]$
[admin@HPG5L3 ~]$
I don't know the root cause why I modified failed, would you please help me debug it how to modify the total_fields value? Thank you.