Graylog & PaloAlto - Limit of total fields has been exceeded?

[Ponet (Jesse Hills)]

See the below:

Graylog: ES Log: Limit of total fields [1000] in index [graylog_519] has been exceeded and no longer processing

The thread on the Elastic discussion boards you’ve linked to already shows how to increase the maximum number of fields per index/mapping, also see https://www.elastic.co/guide/en/elasticsearch/reference/5.5/mapping.html#mapping-limit-settings for details. This being said, I think having 1000 different fields in one index is a bit excessive and you should think about splitting up your messages in different index sets, so that each index has less than 1000 different fields: http://docs.graylog.o…