Use the following settings to limit the number of field mappings (created manually or dynamically) and prevent documents from causing a mapping explosion:
The maximum number of fields in an index. Field and object mappings, as well as field aliases count towards this limit. Mapped runtime fields count towards this limit as well. The default value is
The limit is in place to prevent mappings and searches from becoming too large. Higher values can lead to performance degradations and memory issues, especially in clusters with a high load or few resources.
If you increase this setting, we recommend you also increase the
indices.query.bool.max_clause_countsetting, which limits the maximum number of clauses in a query.
If your field mappings contain a large, arbitrary set of keys, consider using the flattened data type.
The maximum depth for a field, which is measured as the number of inner
objects. For instance, if all fields are defined at the root object level,
then the depth is
1. If there is one object mapping, then the depth is
2, etc. Default is
The maximum number of distinct
nestedmappings in an index. The
nestedtype should only be used in special cases, when arrays of objects need to be queried independently of each other. To safeguard against poorly designed mappings, this setting limits the number of unique
nestedtypes per index. Default is
The maximum number of nested JSON objects that a single document can contain across all
nestedtypes. This limit helps to prevent out of memory errors when a document contains too many nested objects. Default is
Setting for the maximum length of a field name. This setting isn’t really something that addresses
mappings explosion but might still be useful if you want to limit the field length.
It usually shouldn’t be necessary to set this setting. The default is okay
unless a user starts to add a huge number of fields with really long names. Default is
Maximum number of time series dimensions for the
index. Defaults to
Intro to Kibana
ELK for Logs & Metrics