Hello guys,
I was wondering why the number of fields in indexes is by default capped at 1000.
Same applies for the query maximum number of fields that can be targeted, which is also capped at 1024.
I mean, this is fine to me, but then why Filebeat default mapping contains approx 2400 fields?
Filebeat index template increase this field limit so no issues while indexing data, but i had troubles with queries in kibana due to exceeding the limit:
"Field expansion matches too many fields, limit: 1024"
That happens even though i'm definitely not using all those fields (I do use about 200-300 hundred of them all).
Is it safe to increase the limit in queries too?
How it impacts Elasticsearch performances?
I read a bunch of threads here on the forum and it seems something one should be concerned of.
Can someone please explain a little further why this limit is exceeded by Filebeat and what are the consequences?
Many thanks
Alessandro