diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index d845de7ee8a..dd97d7fa922 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -430,6 +430,7 @@ field. You can revert this change by configuring tags for the module and omittin - Add the `overwrite_keys` configuration option to the dissect processor. {pull}19464[19464] - Add support to trim captured values in the dissect processor. {pull}19464[19464] - Added the `max_cached_sessions` option to the script processor. {pull}19562[19562] +- Set index.max_docvalue_fields_search in index template to increase value to 200 fields. {issue}20215[20215] - Add capability of enriching process metadata with contianer id also for non-privileged containers in `add_process_metadata` processor. {pull}19767[19767] *Auditbeat* diff --git a/libbeat/template/template.go b/libbeat/template/template.go index b11599eb205..dac3a920196 100644 --- a/libbeat/template/template.go +++ b/libbeat/template/template.go @@ -32,9 +32,10 @@ import ( var ( // Defaults used in the template - defaultDateDetection = false - defaultTotalFieldsLimit = 10000 - defaultNumberOfRoutingShards = 30 + defaultDateDetection = false + defaultTotalFieldsLimit = 10000 + defaultNumberOfRoutingShards = 30 + defaultMaxDocvalueFieldsSearch = 200 // Array to store dynamicTemplate parts in dynamicTemplates []common.MapStr @@ -325,6 +326,10 @@ func buildIdxSettings(ver common.Version, userSettings common.MapStr) common.Map indexSettings.Put("query.default_field", fields) } + if ver.Major >= 6 { + indexSettings.Put("max_docvalue_fields_search", defaultMaxDocvalueFieldsSearch) + } + indexSettings.DeepUpdate(userSettings) return indexSettings } diff --git a/libbeat/template/template_test.go b/libbeat/template/template_test.go index 7e6a688db5d..52080274dd6 100644 --- a/libbeat/template/template_test.go +++ b/libbeat/template/template_test.go @@ -113,6 +113,7 @@ func TestTemplate(t *testing.T) { template.Assert("index_patterns", []string{"testbeat-" + currentVersion + "-*"}) template.Assert("order", 1) template.Assert("mappings.doc._meta", common.MapStr{"beat": "testbeat", "version": currentVersion}) + template.Assert("settings.index.max_docvalue_fields_search", 200) }) t.Run("for ES 7.x", func(t *testing.T) { @@ -120,6 +121,7 @@ func TestTemplate(t *testing.T) { template.Assert("index_patterns", []string{"testbeat-" + currentVersion + "-*"}) template.Assert("order", 1) template.Assert("mappings._meta", common.MapStr{"beat": "testbeat", "version": currentVersion}) + template.Assert("settings.index.max_docvalue_fields_search", 200) }) t.Run("for ES 8.x", func(t *testing.T) { @@ -127,6 +129,7 @@ func TestTemplate(t *testing.T) { template.Assert("index_patterns", []string{"testbeat-" + currentVersion + "-*"}) template.Assert("order", 1) template.Assert("mappings._meta", common.MapStr{"beat": "testbeat", "version": currentVersion}) + template.Assert("settings.index.max_docvalue_fields_search", 200) }) }