max_analyzed_offset

anonymous@undisclosed.example.com (Anonymous) — Tue, 31 Dec 2024 08:55:16 +0000

2026/05/14 16:54	current
Line 1:	Line 1:
	+	====== max_analyzed_offset ======

	+	You are likely here because you saw this error in ELK:
	+	<code>
	+	The length [1650940] of field [log] in doc[0]/index[logstash-2024.12.21] exceeds the
	+	[index.highlight.max_analyzed_offset] limit [1000000]. To avoid this error, set the
	+	query parameter [max_analyzed_offset] to a value less than index setting [1000000]
	+	and this will tolerate long field values by truncating them.
	+	</code>
	+
	+	Raise it to next million, for example if you got 1650940, then raise to 2000001 (the added 1 will hint others that it was manually set:
	+	<code>
	+	/mnt/common/bin/fix_max_analyzed_offset.sh prod2 2000001
	+	</code>

f1xska - topic:gendoc:elk