# 非法参数异常：索引 [logs-2025] 中类型为 [keyword] 的字段 [user.name] 的长度为 [32768]，超过了字段数据允许的最大长度 [8191]

- **ID:** `elasticsearch/field-capping-exception`
- **领域:** elasticsearch
- **类别:** data_error
- **验证级别:** ai_generated
- **修复率:** 92%

## 根因

一个关键字字段包含的值超过了字段数据加载的最大长度，导致聚合或排序操作失败。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 7.16.0 | active | — | — |
| 8.0.0 | active | — | — |
| 8.11.0 | active | — | — |

## 解决方案

1. ```
   Change the field mapping from keyword to text with a keyword sub-field that has ignore_above set to a larger value or disabled: PUT /logs-2025/_mapping { 'properties': { 'user.name': { 'type': 'text', 'fields': { 'keyword': { 'type': 'keyword', 'ignore_above': 100000 } } } } }
   ```
2. ```
   Use a runtime field to truncate the value before aggregation: GET /logs-2025/_search { 'runtime_mappings': { 'user.name.truncated': { 'type': 'keyword', 'script': 'emit(doc["user.name"].value.substring(0, 8000))' } }, 'aggs': { 'by_name': { 'terms': { 'field': 'user.name.truncated' } } } }
   ```

## 无效尝试

- **** — Increasing the fielddata limit via indices.fielddata.cache.size only affects cache size, not the per-field length limit which is hardcoded. (70% 失败率)
- **** — Reindexing the same data without changing the mapping or field type will reproduce the error. (90% 失败率)