Update ignore_above parameter permanently

Graylog Central (peer support)
1

Hello,
To prevent getting this message: "{“type”:“illegal_argument_exception”,“reason”:“Document contains at least one immense term in field=“full_request” (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms.”
I’m updating full_request field in current index by:

PUT graylog_xxx/_mapping/message
{
“properties”: {
“full_request” : {
“type” : “keyword”,
“ignore_above”: 8191
}
}
}
How it can be done for all future indices? I tried to add it to graylog-custom-mapping, but with no success.
Thanks in advance

2

you have to create a map, and you can assign the map with index name.

https://docs.graylog.org/en/3.1/pages/configuration/elasticsearch.html#custom-index-mappings

{
  "template": "graylog_*",
  "mappings" : {
    "message" : {
      "properties" : {
        "field_ip" : {
          "type" : "ip",
          "index" : "false"
        },
...

//YES, you HAVE TO make the json syntax correct with completion…

3

It worked, thank you

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.