mirrors
/
elasticsearch
mirror of https://mirror.osredm.com/root/elasticsearch.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Explain `ignore_above` better (#129284) 

This concept is complicated.

Closes #128991

Co-authored-by: Larisa Motova <larisa@motovs.org>
Co-authored-by: Liam Thompson <32779855+leemthompo@users.noreply.github.com>
This commit is contained in:
Nik Everett 2025-07-17 15:40:17 -04:00 committed by GitHub
parent 56477d81a9
commit 6ed50e1bae
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/reference/elasticsearch/mapping-reference/keyword.md
View File

@ -70,7 +70,19 @@ The following parameters are accepted by `keyword` fields:
: Multi-fields allow the same string value to be indexed in multiple ways for different purposes, such as one field for search and a multi-field for sorting and aggregations.
[`ignore_above`](/reference/elasticsearch/mapping-reference/ignore-above.md)
: Do not index any string longer than this value. Defaults to `2147483647` in standard indices so that all values would be accepted, and `8191` in logsdb indices to protect against Lucene's term byte-length limit of `32766`. Please however note that default dynamic mapping rules create a sub `keyword` field that overrides this default by setting `ignore_above: 256`.
: Do not index any field containing a string with more characters than this value. This is important because {{es}}
will reject entire documents if they contain keyword fields that exceed `32766` UTF-8 encoded bytes.
To avoid any risk of document rejection, set this value to `8191` or less. Fields with strings exceeding this
length will be excluded from indexing.
The defaults are complicated:
| Index type | Default | Effect |
| ---------- | ------- | ------ |
| Standard indices | `2147483647` (effectively unbounded) | Documents will be rejected if this keyword exceeds `32766` UTF-8 encoded bytes. |
| `logsdb` indices | `8191` | This `keyword` field will never cause documents to be rejected. If this field is longer than `8191` characters it won't be indexed but its values are still available from `_source`. |
| [dynamic mapping](docs-content://manage-data/data-store/mapping/dynamic-mapping.md) for string fields | `text` field with a [sub](/reference/elasticsearch/mapping-reference/multi-fields.md)-`keyword` field with an `ignore_above` of `256` | All string fields are available. Values longer than 256 characters are only available for full text search and won't have a value in their `.keyword` sub-field, so they can not be used for exact matching over _search. |
[`index`](/reference/elasticsearch/mapping-reference/mapping-index.md)
: Should the field be quickly searchable? Accepts `true` (default) and `false`. `keyword` fields that only have [`doc_values`](/reference/elasticsearch/mapping-reference/doc-values.md) enabled can still be queried, albeit slower.