ignore_above index setting
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
The ignore_above field-level setting can also be applied at the index level using index.mapping.ignore_above. This setting lets you define a maximum string length for all applicable fields across the index, including keyword, wildcard, and keyword values in flattened fields. Any values that exceed this limit will be ignored during indexing and won’t be stored.
This index-level setting ensures a consistent approach to managing excessively long values. It works the same as the field-level setting—if a string’s length goes over the specified limit, that string won’t be indexed or stored. When dealing with arrays, each element is evaluated separately, and only the elements that exceed the limit are ignored.
PUT my-index-000001{ "settings": { "index.mapping.ignore_above": 256 } }
In this example, all applicable fields in my-index-000001 will ignore any strings longer than 256 characters.
You can override this index-wide setting for specific fields by specifying a custom ignore_above value in the field mapping.
Just like the field-level ignore_above, this setting only affects indexing and storage. The original values are still available in the _source field if _source is enabled, which is the default behavior in Elasticsearch.