Is there a way to change this 256 threshold from UI?
We are using monthly auto indexing (one index per month). How do we overcome the challenge of not having to update the index every month?
Example: If index get auto generated at 12:00 AM and we update this index at 4:00 AM. Will the logs written in these 4hrs gap gets updated with new threshold mapping and shown on Kibana? or 'Reload indices' from index management page will help us get this done?
Any process/steps to achieve updating mappings at whole Kibana instance level (rather than on each index)?
Do not index any string longer than this value. Defaults to 2147483647 so that all values would be accepted. Please however note that default dynamic mapping rules create a sub keyword field that overrides this default by setting ignore_above: 256.
This is a setting on Elasticsearch, and not from Kibana. If this is on a keyword subfield, the parent field may still index the data as a text type, so OK for search but not for aggregation.