关于kibana 查询出现 55分片有 1 个失败 Elasticsearch ！

日常记录

最近ELFK遇到了一个问题。打开kibana页面右下角报错了。

如标题一样，百度一番后，去查看服务日志。

ES输出的日志目录设置的是：

/usr/local/elasticsearch/elk.log
#打开后发现以下输入内容
[2023-03-28T11:11:26,368][DEBUG][o.e.a.s.TransportSearchAction] [elk-169] [1039623] Failed to execute fetch phase
org.elasticsearch.transport.RemoteTransportException: [elk-170][172.16.128.170:9300][indices:data/read/search[phase/fetch/id]]
Caused by: java.lang.IllegalArgumentException: The length of [message] field of [72gyJocBXK7cIB2BRtJP] doc of [java-log2023.03.28] index has exceeded [1000000] - maximum allowed to be analyzed for highlighting. This maximum can be set by changing the [index.highlight.max_analyzed_offset] index level setting. For large texts, indexing with offsets or term vectors is recommended!
        at org.elasticsearch.search.fetch.subphase.highlight.UnifiedHighlighter.highlight(UnifiedHighlighter.java:89) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.search.fetch.subphase.highlight.HighlightPhase.hitExecute(HighlightPhase.java:107) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.search.fetch.FetchPhase.execute(FetchPhase.java:169) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.search.SearchService.lambda$executeFetchPhase$5(SearchService.java:507) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.search.SearchService$1.doRun(SearchService.java:347) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:44) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:758) ~[elasticsearch-7.2.0.jar:7.2.0]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-7.2.0.jar:7.2.0]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[?:1.8.0_221]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[?:1.8.0_221]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_221]

翻译：索引的[72gyJocBXK7cIB2BRtJP]文档的[message]字段的长度已超过[100000]-允许分析以突出显示的最大值。可以通过更改[index.highlight.max_analyzed_offset]索引级别设置来设置此最大值。对于大型文本，建议使用偏移量或术语向量进行索引！

 解决办法：

PUT /_settings
 {
    "index" : {
        "highlight.max_analyzed_offset" : 100000000
    }
}

后续再观察下。如果有其他报错再更新。

浏览官网可知：

突出显示没有偏移或术语向量的索引文本，需要在搜索请求期间实时分析内存中的该文本。对于大文本，此分析可能需要大量时间和内存。为了防止这种情况，将分析的最大字符数限制为 1000000。可以使用 index 设置为特定索引更改此默认限制index.highlight.max_analyzed_offset。