# Increase ignore\_above for custom field

**URL:** <https://discuss.elastic.co/t/increase-ignore-above-for-custom-field/173282>\
**Category:** Elasticsearch\
**Created:** [March 21, 2019, 10:04am UTC](https://discuss.elastic.co/t/increase-ignore-above-for-custom-field/173282 "2019-03-21T10:04:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leprovokateur](https://avatars.discourse-cdn.com/v4/letter/l/8e8cbc/32.png) [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\
**Post date:** [March 21, 2019, 10:04am UTC](https://discuss.elastic.co/t/increase-ignore-above-for-custom-field/173282/1 "2019-03-21T10:04:23Z")

</div>

Hi,

I use filebeat, logstash, and elasticsearch to index log messages, kibana for visualization.

Within logstash I use grok to split the message into different fields, one of which is "logmessage". If "logmessage" is too long, it is not indexed in elasticsearch and the value for "logmessage" is missing in visualizations, but visible in Discover. I suspect the value of ignore\_above of 256 being the culprit as the missing values for logmessage are strings longer than 256 characters.

Where do I configure easily and sustainably the value of ignore\_above for "logmessage"?

Thanks,  
Robert

---

<div class="post-metadata">

**Author:** ![leprovokateur](https://avatars.discourse-cdn.com/v4/letter/l/8e8cbc/32.png) [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\
**Post date:** [March 21, 2019, 1:51pm UTC](https://discuss.elastic.co/t/increase-ignore-above-for-custom-field/173282/2 "2019-03-21T13:51:11Z")

</div>

Hi,

I somehow solved the problem with

```
PUT _template/filebeat
{
  "index_patterns": ["filebeat-*"],
  "mappings":{
    "doc":{
"properties": {
            "logmessage" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 10000
                }
              }
            }
          }
}}} 

```

But, I would like to know how to achieve this using filebeat. Anybody?

Regards,  
Robert

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2019, 2:03pm UTC](https://discuss.elastic.co/t/increase-ignore-above-for-custom-field/173282/3 "2019-04-18T14:03:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.