elasticsearch data_error ai_generated true

非法参数异常：索引 [logs-2025] 中类型为 [keyword] 的字段 [user.name] 的长度为 [32768]，超过了字段数据允许的最大长度 [8191]

IllegalArgumentException: Field [user.name] of type [keyword] in index [logs-2025] has a length of [32768] which exceeds the maximum allowed length of [8191] for fielddata

ID: elasticsearch/field-capping-exception

其他格式: JSON · Markdown 中文 · English
92%修复率
88%置信度
1证据数
2023-08-25首次发现

版本兼容性

版本状态引入弃用备注
7.16.0 active — — —
8.0.0 active — — —
8.11.0 active — — —

根因分析

一个关键字字段包含的值超过了字段数据加载的最大长度，导致聚合或排序操作失败。

English

A keyword field contains a value that exceeds the maximum length for fielddata loading, causing aggregation or sorting operations to fail.

generic

官方文档

https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html

解决方案

  1. Change the field mapping from keyword to text with a keyword sub-field that has ignore_above set to a larger value or disabled: PUT /logs-2025/_mapping { 'properties': { 'user.name': { 'type': 'text', 'fields': { 'keyword': { 'type': 'keyword', 'ignore_above': 100000 } } } } }
  2. Use a runtime field to truncate the value before aggregation: GET /logs-2025/_search { 'runtime_mappings': { 'user.name.truncated': { 'type': 'keyword', 'script': 'emit(doc["user.name"].value.substring(0, 8000))' } }, 'aggs': { 'by_name': { 'terms': { 'field': 'user.name.truncated' } } } }

无效尝试

常见但无效的做法:

  1. 70% 失败

    Increasing the fielddata limit via indices.fielddata.cache.size only affects cache size, not the per-field length limit which is hardcoded.

  2. 90% 失败

    Reindexing the same data without changing the mapping or field type will reproduce the error.