Skip to content

Explain ignore_above better #129284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
+15 −1
Open

Explain ignore_above better #129284

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5d6fc66
Explain `ignore_above` better
nik9000 Jun 11, 2025
c1c509d
Format
nik9000 Jun 12, 2025
6f9f2bb
Explain more
nik9000 Jun 12, 2025
c3c7206
Apply suggestions from code review
nik9000 Jun 12, 2025
eaefb8d
More
nik9000 Jun 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion docs/reference/elasticsearch/mapping-reference/keyword.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,19 @@ The following parameters are accepted by `keyword` fields:
: Multi-fields allow the same string value to be indexed in multiple ways for different purposes, such as one field for search and a multi-field for sorting and aggregations.

[`ignore_above`](/reference/elasticsearch/mapping-reference/ignore-above.md)
: Do not index any string longer than this value. Defaults to `2147483647` in standard indices so that all values would be accepted, and `8191` in logsdb indices to protect against Lucene's term byte-length limit of `32766`. Please however note that default dynamic mapping rules create a sub `keyword` field that overrides this default by setting `ignore_above: 256`.
: Do not index any string with more characters than this value. This is important because `keyword`
fields will reject documents with `keyword` fields that encode to utf-8 longer than `32766` bytes.

If you need to never reject documents, this should have some value `<=8191`. All documents with
more characters will just skip building the index for this field.

The defaults are complicated. It's `2147483647` (effectively unbounded) in standard indices and
Copy link
Contributor

@leemthompo leemthompo Jun 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider using bullets for defaults/dynamic mapping info for readability

`8191` in logsdb indices. So, if unspecified, standard indices *can* reject documents. And logsdb indices
will index the document, but skip this field.

The [dynamic mapping](docs-content://manage-data/data-store/mapping/dynamic-mapping.md) for string fields
defaults to a `text` field with a sub-`keyword` field with an `ignore_above` of `256`. This indexes
all values for full text search, and indexes short values get indexed for exact matching and aggregation.

[`index`](/reference/elasticsearch/mapping-reference/mapping-index.md)
: Should the field be quickly searchable? Accepts `true` (default) and `false`. `keyword` fields that only have [`doc_values`](/reference/elasticsearch/mapping-reference/doc-values.md) enabled can still be queried, albeit slower.
Expand Down
Loading