Limitation of maximum length of strings?

Question

Hello,

is there a limitation of the "Maximum length" of an indexfield (String)?
Standard Value is 50. Is there a recommendation or any known issues how long this indexfield can be?

If not, we would set it to 1000.

Thanks for your help

Answer 1

The limit is defined by the underlying database system. The maximum string length for ms sql server is 4000 characters and for oracle sql server 2000 characters.

If you want more character than that, then the long string (Zeichenkette lang) type will support it, but it will be a blob field in the database and the text will not be indexed in the elasticsearch database.

Comments

Ok great Thank you!

---

As far as I can remember, StringEx (long strings) are also indexed.

However, there is a limit of around 32kB that is imposed by elasticsearch ( https://github.com/Graylog2/graylog2-server/issues/873 ). So, the really long strings will not be searchable, but there is little to be done here unless elastic changes their policy.

---

I checked with the developer: You are right, the entire text will be indexed and is searchable but it can not be used for aggregation - e.g. as structure elements. In the db it will be a blob.