Revisit maxLength=1024 restrictions on Intake API

Open simitt opened this issue 3 years ago • 1 comments

We should follow current conversations around increasing or removing the ignore_above=1024 restrictions on ECS on keywords (https://github.com/elastic/ecs/issues/105). If ECS and libbeat (https://github.com/elastic/beats/blob/master/libbeat/_meta/fields.ecs.yml#L51) change the limitations, we should make use of that and also revisit the limitations on the intake API.

Aug 01 '22 09:08 simitt

Just registering that error.stack_trace might be another prime candidate for removal of ignore_above (or increasing it).

Jul 30 '24 07:07 Mpdreamz