Increase total fields limit via creation of index in logstash

It cannot be done directly in the Logstash configuration. You will have to put it in an index template. The default index template Logstash provides only matches indices with a logstash-* name pattern.

The current 5.x template can be found here.

As the setting is index.mapping.total_fields.limit: 2000, it should fit before or after line 5 in that example, leaving it looking something like:

  "settings" : {
    "index.refresh_interval" : "5s",
    "index.mapping.total_fields.limit": 2000
  },

You can take this file and edit it as needed, particularly line 2, which currently reads "template" : "logstash-*", should match your index name pattern.

As far as putting that new template in, you can do so with these Logstash template directives in the elasticsearch output plugin block:

  manage_template => true
  template => '/path/to/template.json'
  template_name => 'a_valid_name_here' # The default is logstash
  template_overwrite => true