# IllegalArgumentException: Field [user.name] of type [keyword] in index [logs-2025] has a length of [32768] which exceeds the maximum allowed length of 32766

- **ID:** `elasticsearch/field-length-exceeds-keyword-limit`
- **Domain:** elasticsearch
- **Category:** data_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

A document contains a keyword field value that exceeds the 32766-byte limit, causing indexing rejection.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 7.10.0 | active | — | — |
| 8.10.0 | active | — | — |
| 8.13.0 | active | — | — |

## Workarounds

1. **Change the field type to `text` with a `keyword` subfield for exact matching: `PUT my_index/_mapping { "properties": { "user.name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } }`.** (90% success)
   ```
   Change the field type to `text` with a `keyword` subfield for exact matching: `PUT my_index/_mapping { "properties": { "user.name": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } }`.
   ```
2. **Truncate the field value at the application level before indexing to ensure it stays under 32766 bytes.** (85% success)
   ```
   Truncate the field value at the application level before indexing to ensure it stays under 32766 bytes.
   ```
3. **Use a `keyword` field with `ignore_above` set to a value less than 32766 to skip indexing long values.** (88% success)
   ```
   Use a `keyword` field with `ignore_above` set to a value less than 32766 to skip indexing long values.
   ```

## Dead Ends

- **** — `ignore_above` truncates the field, it does not increase the keyword length limit. (80% fail)
- **** — Removing `ignore_above` does not change the hard byte limit for keyword fields. (90% fail)
- **** — Reindexing without addressing the field type will still reject large values. (85% fail)