# reason"=\>"Limit of total fields \[1000\] in index

**URL:** <https://discuss.elastic.co/t/reason-limit-of-total-fields-1000-in-index/234415>\
**Category:** Logstash\
**Created:** [May 26, 2020, 8:30pm UTC](https://discuss.elastic.co/t/reason-limit-of-total-fields-1000-in-index/234415 "2020-05-26T20:30:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![PraveenKT](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveenkt/32/35483_2.png) [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\
**Post date:** [May 26, 2020, 8:30pm UTC](https://discuss.elastic.co/t/reason-limit-of-total-fields-1000-in-index/234415/1 "2020-05-26T20:30:23Z")

</div>

I am getting below error. but found the events in kibana discovery. Increesed the fileds limit by below.

`````````````````````auto
PUT issqnet-2020.05.26/_settings
{
  "index.mapping.total_fields.limit": 10000
}
```````````````````
incresed and restarted logstash, still issue facing.
````````````````````
[2020-05-26T13:19:26,177][WARN][logstash.outputs.elasticsearch][main][220c76045b556cf67d246e54931c092b729b0e8dcc83cd8283a28d6d531fc2bd] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"%{[@metadata][target_index]}", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x7c80078e>], :response=>{"index"=>{"_index"=>"%{[@metadata][target_index]}", "_type"=>"_doc", "_id"=>"xW2jUnIB3QufrXcV36cQ", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Limit of total fields [1000] in index [%{[@metadata][target_index]}] has been exceeded"}}}}
````````````````````
`````````````````````

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 26, 2020, 8:46pm UTC](https://discuss.elastic.co/t/reason-limit-of-total-fields-1000-in-index/234415/2 "2020-05-26T20:46:03Z")

</div>

> [@PraveenKT](#):
>
> `"Limit of total fields [1000] in index [%{[@metadata][target_index]}] has been exceeded"`

It looks to me like the sprintf reference in the index option of the elasticsearch output did not get substituted, so you are not writing to the index that you changed the settings on.

---

<div class="post-metadata">

**Author:** ![PraveenKT](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/praveenkt/32/35483_2.png) [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\
**Post date:** [May 26, 2020, 8:59pm UTC](https://discuss.elastic.co/t/reason-limit-of-total-fields-1000-in-index/234415/3 "2020-05-26T20:59:25Z")

</div>

issqnet-2020.05.26 index created docs are adding. I am not getting what you told. Can you please explain some more details.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 26, 2020, 9:37pm UTC](https://discuss.elastic.co/t/reason-limit-of-total-fields-1000-in-index/234415/4 "2020-05-26T21:37:26Z")

</div>

elasticsearch is complaining that there are 1000 fields in an index called "%{[@metadata][target\_index]}". If you are using

```
index => "%{[@metadata][target_index]}"

```

in an elasticsearch output in logstash then logstash does the substitution. The only time that elasticsearch would ever see the index name "%{[@metadata][target\_index]}" would be if the [@metadata][target\_index] field does not exist on some events.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2020, 9:37pm UTC](https://discuss.elastic.co/t/reason-limit-of-total-fields-1000-in-index/234415/5 "2020-06-23T21:37:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.