{
  "id": "elasticsearch/field-length-exceeds-keyword-limit",
  "signature": "IllegalArgumentException: Field [user.name] of type [keyword] in index [logs-2025] has a length of [32768] which exceeds the maximum allowed length of 32766",
  "signature_zh": "IllegalArgumentException: 索引 [logs-2025] 中类型为 [keyword] 的字段 [user.name] 长度为 [32768]，超过了最大允许长度 32766",
  "regex": "IllegalArgumentException: Field \\[.*\\] of type \\[keyword\\] in index \\[.*\\] has a length of \\[\\d+\\] which exceeds the maximum allowed length of 32766",
  "domain": "elasticsearch",
  "category": "data_error",
  "subcategory": null,
  "root_cause": "A document contains a keyword field value that exceeds the 32766-byte limit, causing indexing rejection.",
  "root_cause_type": "generic",
  "root_cause_zh": "文档中的关键字字段值超过了 32766 字节的限制，导致索引被拒绝。",
  "versions": [
    {
      "version": "7.10.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "8.10.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "8.13.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "`ignore_above` truncates the field, it does not increase the keyword length limit.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Removing `ignore_above` does not change the hard byte limit for keyword fields.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Reindexing without addressing the field type will still reject large values.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Change the field type to `text` with a `keyword` subfield for exact matching: `PUT my_index/_mapping { \"properties\": { \"user.name\": { \"type\": \"text\", \"fields\": { \"keyword\": { \"type\": \"keyword\", \"ignore_above\": 256 } } } } }`.",
      "success_rate": 0.9,
      "how": "Change the field type to `text` with a `keyword` subfield for exact matching: `PUT my_index/_mapping { \"properties\": { \"user.name\": { \"type\": \"text\", \"fields\": { \"keyword\": { \"type\": \"keyword\", \"ignore_above\": 256 } } } } }`.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Truncate the field value at the application level before indexing to ensure it stays under 32766 bytes.",
      "success_rate": 0.85,
      "how": "Truncate the field value at the application level before indexing to ensure it stays under 32766 bytes.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use a `keyword` field with `ignore_above` set to a value less than 32766 to skip indexing long values.",
      "success_rate": 0.88,
      "how": "Use a `keyword` field with `ignore_above` set to a value less than 32766 to skip indexing long values.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "将字段类型更改为 `text` 并添加 `keyword` 子字段用于精确匹配：`PUT my_index/_mapping { \"properties\": { \"user.name\": { \"type\": \"text\", \"fields\": { \"keyword\": { \"type\": \"keyword\", \"ignore_above\": 256 } } } } }`。",
    "在应用程序级别截断字段值，确保其小于 32766 字节后再索引。",
    "使用带有 `ignore_above` 设置的 `keyword` 字段，设置值小于 32766 以跳过索引长值。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html#keyword-field-type-limits",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2024-06-10",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}