You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Question for discussion: Should ECS set ignore_above by default on flattened fields?
Context
Pointed out in #2237, ECS doesn't yet support setting ignore_above explicitly set on flattened fields (fix incoming).
As a convention, the artifacts generated by ECS set the ignore_above parameter on all keyword fields. Setting ignore_above avoids exceptions due to Lucene size limit for a single term and avoids unnecessarily indexing longer string values.
Other considerations
If ECS did set ignore_above on flattened type fields, should ECS use the existing convention of ignore_above: 1024?
Implications
If set, any fields with character counter > ignore_above will no longer be indexed and only appear in _source.
On the other hand, any flattened field values larger than the Lucene limit of 32766 bytes with cause an exception. Unsure if this affects the entire flattened field or just the specific leaf field that's oversized (but could be easily tested).
The text was updated successfully, but these errors were encountered:
Question for discussion: Should ECS set
ignore_above
by default onflattened
fields?Context
Pointed out in #2237, ECS doesn't yet support setting
ignore_above
explicitly set onflattened
fields (fix incoming).As a convention, the artifacts generated by ECS set the
ignore_above
parameter on allkeyword
fields. Settingignore_above
avoids exceptions due to Lucene size limit for a single term and avoids unnecessarily indexing longer string values.Other considerations
ignore_above
onflattened
type fields, should ECS use the existing convention ofignore_above: 1024
?ignore_above
will no longer be indexed and only appear in_source
.The text was updated successfully, but these errors were encountered: