Index setting is routing

Graylog Central (peer support)
1

since yesterday i got the following error
Elasticsearch exception [type=illegal_argument_exception, reason=Limit of total fields [1000] has been exceeded while adding new fields [1]]];

  • OS Information:
    Ubuntu 20.04
  • Package Version:
    graylog 4.1.14
    elasticsearch “7.17.5”
    i just wanted to get through the command the current total fields setting
    curl -XGET https://elasticcluster.domain.com:9200/graylog_27/_settings
    but i get the following:
    {“graylog_27”:{“settings”:{“index”:{“routing”:{“allocation”:{“include”:{“_tier_preference”:“data_content”}}},“number_of_shards”:“4”,“provided_name”:“graylog_27”,“creation_date”:“1693526406320”,“analysis”:{“analyzer”:{“analyzer_keyword”:{“filter”:“lowercase”,“tokenizer”:“keyword”}}},“number_of_replicas”:“2”,“uuid”:“9jG1wDO2QB-FVQMtuz3BNg”,“version”:{“created”:“7170599”}}}}}
    that irritated me because the index is routed and not mapped. what should i do in this situation
2

Off the top of my head, I don’t know of a way to get a field count for an index, but what you need to do to stop the errors is to split some of your sources up and route them to another index. You have too many sources going into the same index.

Or, if you don’t have many sources, it could be that Ian agent or a parser is misbehaving. This can happen sometimes with NXLog, for example. It will sometimes create junk fields, sometimes many of them.

You need to get the total number of fields down below 1000. Then manually rotate the index and the error will clear.

3

Hello,
you are right, we just start use nxlog to send the eventlog of windows servers to graylog. i created yesterday another index just for the eventlog and this solve the problem. but i just want to know, why the ouput of setting of the index says routing instead of mapping. what is the reason of that?

4

I think you may be referring to index routing. Not sure why that term was chosen, except that index mapping refers to mapping fields to individual indices in Opensearch.

Index routing is a means of telling Graylog to store logs data from particular streams in specific indices. It allows you to set separate rotation and retention periods, and can increase speed and storage efficiency storing like data in discrete indices.

Hope this helps.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.