Long winevent messages cause logstash errors

[Sahale]

Hey!

Sometimes I got such errors in logstash output:

...
response=>{"index"=>{"_index"=>"so-ossec-2022.06.20", "_type"=>"_doc", "_id"=>"b9IQgYEB7SIodTVcFROp", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Document contains at least one immense term in field=\"message.security\" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped.  Please correct the analyzer to not produce such terms.  The prefix of the first immense term is: '[123, 34, 116, 105, 109, 101, 115, 116, 97, 109, 112, 34, 58, 34, 50, 48, 50, 50, 45, 48, 54, 45, 50, 48, 116, 49, 50, 58, 50, 50]...', original message: bytes can be at most 32766 in length; got 43910", "caused_by"=>{"type"=>"max_bytes_length_exceeded_exception", "reason"=>"bytes can be at most 32766 in length; got 43910"}}}}}

Length can be different of course.766
It always generates for really long messages from domain controller, for example.

I tried to add ignore_above option for message.security field by modifying elasticsearch/templates/component/so/dtc-base-mappings.json, but that didn't help.

How can I solve the problem?
Thanks.

[defensivedepth]

We are looking into this issue and will post an update once we have more information.

[samanosuke26]

Bump

[dougburks]

@samanosuke26 Instead of bumping an old discussion from over a year ago, please start a new discussion and provide detailed information about what you're seeing.