@Asa_Zalles-Milner I think you are right on the cause of the problem and it makes sense to work for logstash-env-* and not for logstash-*.
I think the best thing to do here is a solution already posted on other topic (Kibana requesting too many doc values) that I will also transcript here:
- As you suggested, you could try increasing
max_docvalue_fields_searchfor each index, though I have concerns this might not scale. If you continue to index documents with new fields then you'll probably bump up against this limit again.- If you don't actually need to query/aggregate on all of those date fields, then maybe you could try mapping them as strings instead. Then they won't be requested as docvalue fields.
- You could also be trying to fit too many different types of data into a single index pattern, i.e. your index pattern is too greedy. Would your use case could allow you to define index patterns which match fewer indices, and thus include fewer date fields?
Hope that helps,
Cheers