Elasticsearch Field limit more than 1000
- You will have to either set an index template on the cluster.
You can use below template to set the settings for all indices that get added to the cluster. Once you index via logstash, below template will set the field limit to 2000 for all indices that are created.
PUT /_template/Global{ "index_patterns" : ["*"], "order" : 0, "settings" : { "index.mapping.total_fields.limit" : "2000" } }Note: You can change the pattern to "index_patterns" : ["cloudtrail-*"] if you want to use the settings for specific indices.
- Another option is to use a logstash template as explained on this link
You should also consider restructuring your document mapping when the fields in one document go to such a high number, not all fields are always required in the response. Look into creating relations like Join/parent-child etc. to create smaller documents for efficiency.