# Graylog & PaloAlto - Limit of total fields has been exceeded?

**URL:** <https://community.graylog.org/t/graylog-paloalto-limit-of-total-fields-has-been-exceeded/16682>\
**Category:** Graylog Central (peer support)\
**Created:** [August 5, 2020, 2:57pm UTC](https://community.graylog.org/t/graylog-paloalto-limit-of-total-fields-has-been-exceeded/16682 "2020-08-05T14:57:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrihub](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@chrihub](https://community.graylog.org/u/chrihub)\
**Post date:** [August 5, 2020, 2:57pm UTC](https://community.graylog.org/t/graylog-paloalto-limit-of-total-fields-has-been-exceeded/16682/1 "2020-08-05T14:57:11Z")

</div>

Im fairly new to Graylog and I’m very happy to work with this tool. But so maybe my question is quite easy to solve.

I’m trying to import PAN-OS 9.1 Logs into my Graylog 3.3 Installation. Therefore, I installed the Integrations Plugin and started working with the “Palo Alto Networks Input”.  
When configuring my Firewall to send Logs to Graylog, I start receiving the following errormessages:

WARN [Messages] Failed to index message: index= id= error=\<{“type”:“illegal\_argument\_exception”,“reason” :“Limit of total fields [1000] in index [graylog\_499] has been exceeded”}\>

Those messages do definitely not contain more than arround 120 Fields. In PaloAlto I configured the Logs to be sent alternately as IETF or BSD. There was no change.

Did anybody here faced the a similar Issue so far?

Kind Regards  
Christian

---

<div class="post-metadata">

**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\
**Post date:** [August 5, 2020, 4:53pm UTC](https://community.graylog.org/t/graylog-paloalto-limit-of-total-fields-has-been-exceeded/16682/2 "2020-08-05T16:53:19Z")

</div>

See the below:

> [@Graylog: ES Log: Limit of total fields \[1000\] in index \[graylog\_519\] has been exceeded and no longer processing](https://community.graylog.org/t/graylog-es-log-limit-of-total-fields-1000-in-index-graylog-519-has-been-exceeded-and-no-longer-processing/2009/3):
>
> The thread on the Elastic discussion boards you’ve linked to already shows how to increase the maximum number of fields per index/mapping, also see [https://www.elastic.co/guide/en/elasticsearch/reference/5.5/mapping.html#mapping-limit-settings](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/mapping.html#mapping-limit-settings) for details. This being said, I think having 1000 different fields in one index is a bit excessive and you should think about splitting up your messages in different index sets, so that each index has less than 1000 different fields: [http://docs.graylog.o…](http://docs.graylog.org/en/2.3/pages/configuration/index_model.html)

---

<div class="post-metadata">

**Author:** ![chrihub](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@chrihub](https://community.graylog.org/u/chrihub)\
**Post date:** [August 6, 2020, 12:57pm UTC](https://community.graylog.org/t/graylog-paloalto-limit-of-total-fields-has-been-exceeded/16682/3 "2020-08-06T12:57:27Z")

</div>

Thanks for your feedback. Your feedback helped me to understand the error message. Mistakenly I interpreted the Errormessage in that way that one incoming Logmessage contains more than 1000 Fields what is not the case. I’m going to split up the indexes as you suggested.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 20, 2020, 12:57pm UTC](https://community.graylog.org/t/graylog-paloalto-limit-of-total-fields-has-been-exceeded/16682/4 "2020-08-20T12:57:41Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.