{"record":{"id":"26ba52e247295a70","repo":"elastic/elasticsearch","slug":"field-has-an-attachment-field-size-of-by-26ba52","errorCode":null,"errorMessage":"field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size of [{}] bytes due to setting [{}={}]","messagePattern":"field \\[(.+?)\\] has an attachment field size of \\[(.+?)\\] bytes exceeding the maximum allowed input size of \\[(.+?)\\] bytes due to setting \\[(.+?)=(.+?)\\]","errorType":"exception","errorClass":"ElasticsearchParseException","httpStatus":null,"severity":"error","filePath":"modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/AttachmentProcessor.java","lineNumber":150,"sourceCode":"        }\n        long heapMaxBytes = JvmInfo.jvmInfo().getMem().getHeapMax().getBytes();\n        if (heapMaxBytes <= 0) {\n            return -1L;\n        }\n        return maxFieldSizeFromNode.calculateValue(ByteSizeValue.ofBytes(heapMaxBytes), null).getBytes();\n    }\n\n    private void checkMaxAttachmentFieldSize(final int fieldSizeBytes) {\n        if (maxFieldSizeFromNodeBytes >= 0 && fieldSizeBytes > maxFieldSizeFromNodeBytes) {\n            if (Strings.hasLength(maxFieldSizeExceededMessage)) {\n                throw new ElasticsearchParseException(\n                    \"field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size {}\",\n                    field,\n                    fieldSizeBytes,\n                    maxFieldSizeExceededMessage\n                );\n            }\n            throw new ElasticsearchParseException(\n                \"field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size of [{}] bytes \"\n                    + \"due to setting [{}={}]\",\n                field,\n                fieldSizeBytes,\n                maxFieldSizeFromNodeBytes,\n                MAX_FIELD_SIZE_SETTING.getKey(),\n                maxFieldSizeFromNode.getStringRep()\n            );\n        }\n        if (maxFieldBytesFromProcessor >= 0 && fieldSizeBytes > maxFieldBytesFromProcessor) {\n            throw new ElasticsearchParseException(\n                \"field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed processor size of [{}] bytes\",\n                field,\n                fieldSizeBytes,\n                maxFieldBytesFromProcessor\n            );\n        }\n    }","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/AttachmentProcessor.java#L132-L168","documentation":"Same checkMaxAttachmentFieldSize guard as the suffix variant, but this is the default branch: the node-level max_field_size cap is exceeded and no custom suffix is configured, so the message reports the concrete byte limit and the ingest.attachment.max_field_size setting value that produced it.","triggerScenarios":"Attachment processor field raw bytes exceed maxFieldSizeFromNodeBytes and maxFieldSizeExceededMessage is empty (Strings.hasLength false). The second throw in checkMaxAttachmentFieldSize fires.","commonSituations":"Default deployment with large documents; heap-relative cap tighter than expected after a heap resize; ratio value resolving to a smaller absolute number than assumed.","solutions":["Increase ingest.attachment.max_field_size (and ensure the JVM heap supports it)","Shrink or pre-process the incoming binary","Move heavy attachment parsing out of the ingest pipeline to a dedicated enrichment stage"],"exampleFix":"// before: ingest.attachment.max_field_size=-1 resolves against heap and still too small? set an absolute cap\nPUT _cluster/settings\n{\"persistent\":{\"ingest.attachment.max_field_size\":\"512mb\"}}","handlingStrategy":"validation","validationCode":"long cap = maxFieldSizeFromNodeBytes; // resolved from setting\nif (rawBytes > cap) { /* reject upstream or shrink input */ }","typeGuard":null,"tryCatchPattern":"try { ingest(pipeline); }\ncatch (ElasticsearchParseException e) {\n    if (e.getMessage().contains(\"max_field_size\")) { /* increase setting or reject doc */ }\n    else throw e;\n}","preventionTips":["Set an explicit absolute cap rather than relying on heap-ratio defaults","Track heap size changes that silently shrink ratio-based caps","Pre-process oversized binaries out of the hot ingest path"],"tags":["ingest","attachment","tika","size-limit","node-setting"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}