User Tools

Site Tools


topic:gendoc:elk:max_analyzed_offset

max_analyzed_offset

You are likely here because you saw this error in ELK:

The length [1650940] of field [log] in doc[0]/index[logstash-2024.12.21] exceeds the
[index.highlight.max_analyzed_offset] limit [1000000]. To avoid this error, set the
query parameter [max_analyzed_offset] to a value less than index setting [1000000]
and this will tolerate long field values by truncating them.

Raise it to next million, for example if you got 1650940, then raise to 2000001 (the added 1 will hint others that it was manually set:

/mnt/common/bin/fix_max_analyzed_offset.sh prod2 2000001
topic/gendoc/elk/max_analyzed_offset.txt · Last modified: 2024/12/31 08:55 by 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki