elk报错：[syslogs] index has exceeded [1000000]

Jiangxl~

已于 2022-07-29 15:03:09 修改

阅读量1.2k

点赞数 13

分类专栏： Elaticsearch+ELK 文章标签： elk

于 2022-07-29 13:57:59 首次发布

本文链接：https://blog.csdn.net/weixin_44953658/article/details/126054361

版权

Elaticsearch+ELK 专栏收录该内容

33 篇文章 43 订阅

订阅专栏

报错内容：
The length of [日志详情.keyword] field of [fDc4RoIBa4doANsQMBzx] doc of [elk-xbtstu-tj-prod-2022.07.28][syslogs] index has exceeded [1000000] -maximum allowed to be analyzed for highlighting. This maximum can be set by changing the [index.highlight.max_analyzed_offset] index level setting. For large texts, indexing with offsets or term vectors is recommended!
在这里插入图片描述

解决方法

curl -XPUT "http://ip:port/_settings" -H 'Content-Type: application/json' -d' {
    "index" : {
        "highlight.max_analyzed_offset" : 100000000
    }
}'