# Limit Of Total Fields in index has been exceeded

**URL:** <https://discuss.elastic.co/t/limit-of-total-fields-in-index-has-been-exceeded/142143>\
**Category:** Elasticsearch\
**Created:** [July 30, 2018, 9:46am UTC](https://discuss.elastic.co/t/limit-of-total-fields-in-index-has-been-exceeded/142143 "2018-07-30T09:46:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akhilesh-Tiwari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh-tiwari/32/32965_2.png) [@Akhilesh-Tiwari](https://discuss.elastic.co/u/Akhilesh-Tiwari)\
**Post date:** [July 30, 2018, 9:46am UTC](https://discuss.elastic.co/t/limit-of-total-fields-in-index-has-been-exceeded/142143/1 "2018-07-30T09:46:40Z")

</div>

Hi Team,

when i am trying to push data from Filebeat to logstash and elasticsearch by using my log file,I am getting an exception.

"Java.lang.IllegalArgumentException:Limit Of Total Fields [1000] in index has been exceeded"

and then after i am getting

"Java.lang.OutOfMemeryError:java heap error"

can you please help me for this issue.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 30, 2018, 9:49am UTC](https://discuss.elastic.co/t/limit-of-total-fields-in-index-has-been-exceeded/142143/2 "2018-07-30T09:49:13Z")

</div>

What does your mapping for that index look like? Which version are you using? What is the specification of your cluster?

---

<div class="post-metadata">

**Author:** ![Akhilesh-Tiwari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhilesh-tiwari/32/32965_2.png) [@Akhilesh-Tiwari](https://discuss.elastic.co/u/Akhilesh-Tiwari)\
**Post date:** [July 30, 2018, 9:56am UTC](https://discuss.elastic.co/t/limit-of-total-fields-in-index-has-been-exceeded/142143/3 "2018-07-30T09:56:30Z")

</div>

Hi @Christian_Dahlqvist,

I am using Filebeat 6.0.0,logstash 6.3.0 and Elasticsearch 6.3.0.

**Filebeat.yml is**

input\_type: log  
paths:  
/app/DPlogs/Smart.2018-07-23.54.log  
fields: {log\_type: smart\_logtype\_original}  
include\_lines: ["\< App Id : SMART-WEB-APPLICATION \>"]

output.logstash:  
output.logstash.hosts: ["172.21.153.176:5044"]  
output.logstash.protocol: "http"  
output.logstash.index: "beat\_server\_latest-%{+YYYY.MM.dd}"  
output.logstash.template.name: "appstash"  
output.logstash.template.path: "filebeat.template.json"  
output.logstash.template.overwrite: false

**Logstash.yml**

input {  
beats {  
port =\> 5044  
}  
}  
filter {  
ruby {  
code =\> "  
fieldArray = event.get('message').split(' \> \< ')  
for field in fieldArray  
field = field.delete '\< '  
field = field.delete ' \>'  
result = field.split(' : ')  
event.set(result[0], result[1])  
end  
"  
}  
}

output {

if [fields][log\_type] == "smart\_logtype\_original"{

elasticsearch {

```
  hosts => "172.21.153.176:9200"
  index => "smart_index1"
  #user => "RonakB"
  #password => "June@2018"
  #ssl => true
  #ssl_certificate_verification => false
  #truststore => "/opt/READONLYREST/elasticsearch-6.3.0/config/keystore.jks"
  #truststore_password => "readonlyrest"

 }

```

}

if [fields][log\_type] == "smart\_logtype"{

elasticsearch {

```
  hosts => "172.21.153.176:9200"
  index => "smart_index"

 }

```

}

}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 30, 2018, 9:58am UTC](https://discuss.elastic.co/t/limit-of-total-fields-in-index-has-been-exceeded/142143/4 "2018-07-30T09:58:45Z")

</div>

That is not what I asked for. What is the mapping of the index you had the error reported for? Use the [get mapping API](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/indices-get-mapping.html) to retrieve it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 9:58am UTC](https://discuss.elastic.co/t/limit-of-total-fields-in-index-has-been-exceeded/142143/5 "2018-08-27T09:58:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.