# IllegalArgumentException: Field [user.name] of type [keyword] in index [logs-2025] has a length of [32768] which exceeds the maximum allowed length of [8191] for fielddata

- **ID:** `elasticsearch/field-capping-exception`
- **Domain:** elasticsearch
- **Category:** data_error
- **Verification:** ai_generated
- **Fix Rate:** 92%

## Root Cause

A keyword field contains a value that exceeds the maximum length for fielddata loading, causing aggregation or sorting operations to fail.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 7.16.0 | active | — | — |
| 8.0.0 | active | — | — |
| 8.11.0 | active | — | — |

## Workarounds

1. **Change the field mapping from keyword to text with a keyword sub-field that has ignore_above set to a larger value or disabled: PUT /logs-2025/_mapping { 'properties': { 'user.name': { 'type': 'text', 'fields': { 'keyword': { 'type': 'keyword', 'ignore_above': 100000 } } } } }** (85% success)
   ```
   Change the field mapping from keyword to text with a keyword sub-field that has ignore_above set to a larger value or disabled: PUT /logs-2025/_mapping { 'properties': { 'user.name': { 'type': 'text', 'fields': { 'keyword': { 'type': 'keyword', 'ignore_above': 100000 } } } } }
   ```
2. **Use a runtime field to truncate the value before aggregation: GET /logs-2025/_search { 'runtime_mappings': { 'user.name.truncated': { 'type': 'keyword', 'script': 'emit(doc["user.name"].value.substring(0, 8000))' } }, 'aggs': { 'by_name': { 'terms': { 'field': 'user.name.truncated' } } } }** (80% success)
   ```
   Use a runtime field to truncate the value before aggregation: GET /logs-2025/_search { 'runtime_mappings': { 'user.name.truncated': { 'type': 'keyword', 'script': 'emit(doc["user.name"].value.substring(0, 8000))' } }, 'aggs': { 'by_name': { 'terms': { 'field': 'user.name.truncated' } } } }
   ```

## Dead Ends

- **** — Increasing the fielddata limit via indices.fielddata.cache.size only affects cache size, not the per-field length limit which is hardcoded. (70% fail)
- **** — Reindexing the same data without changing the mapping or field type will reproduce the error. (90% fail)