Increase "ignore_above" value for message.keyword

Elastic Stack Elasticsearch
1

Hello,

I am trying to increase the default value for "ignore_above" from 256 to 1024 for the message.keyword field by adding a component index template in Elasticsearch and apply it to the base index pattern.
My index template:

{
  "index_templates" : [
    {
      "name" : "test_index",
      "index_template" : {
        "index_patterns" : [
          "test_index*"
        ],
        "composed_of" : [
          "set_message_keyword_to_1024"
        ],
        "priority" : 0
      }
    }
  ]
}

The resulting command from creating the index component template is:

PUT _component_template/set_message_keyword_to_1024
{
  "template": {
    "mappings": {
      "dynamic_templates": [],
      "properties": {
        "message": {
          "eager_global_ordinals": false,
          "index_phrases": false,
          "fielddata": false,
          "norms": true,
          "index": true,
          "store": false,
          "type": "text",
          "index_options": "positions",
          "fields": {
            "keyword": {
              "eager_global_ordinals": false,
              "norms": false,
              "ignore_above": 1024,
              "index": true,
              "store": false,
              "type": "keyword",
              "split_queries_on_whitespace": false,
              "index_options": "docs",
              "doc_values": true
            }
          }
        }
      }
    }
  }
}

I was only able to create the component index by uploading the following:

"properties": {
  "message": {
    "type": "text",
      "fields": {
        "keyword": {
          "type": "keyword",
          "ignore_above": 1024
        }
      }
  }
}

I have tried a number of other options which all seem to fail to target the message.keyword field.
Is this possible?
I have been posting values in excess of 256 which do not create a message.keyword field, while around 256 characters does create the message.keyword field. I understand this is due to the lucene backend interpreting byte size limitations vs. character count limitations.

I am certain there is a syntax error somewhere here if someone could kindly point it out.

Thanks,

2

So I fixed my issue by deleting everything again and creating again with the same data, but this time the component template produced a different creation command:

PUT _component_template/message_keyword_field_increase
{
  "template": {
    "mappings": {
      "dynamic_templates": [],
      "properties": {
        "message": {
          "type": "text",
          "fields": {
            "keyword": {
              "ignore_above": 1536,
              "type": "keyword"
            }
          }
        }
      }
    }
  }
}

Not sure what the lesson learned here is other than, just try again?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.