{"record":{"id":"584f5b9279945524","repo":"elastic/elasticsearch","slug":"field-has-an-attachment-field-size-of-by","errorCode":null,"errorMessage":"field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size {}","messagePattern":"field \\[(.+?)\\] has an attachment field size of \\[(.+?)\\] bytes exceeding the maximum allowed input size (.+?)","errorType":"exception","errorClass":"ElasticsearchParseException","httpStatus":null,"severity":"error","filePath":"modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/AttachmentProcessor.java","lineNumber":143,"sourceCode":"\n    /**\n     * Resolves {@link #MAX_FIELD_SIZE_SETTING} to an absolute byte cap, or -1 if not applicable.\n     */\n    private static long resolveMaxFieldSizeFromNode(RelativeByteSizeValue maxFieldSizeFromNode) {\n        if (maxFieldSizeFromNode.isAbsolute()) {\n            return maxFieldSizeFromNode.getAbsolute().getBytes();\n        }\n        long heapMaxBytes = JvmInfo.jvmInfo().getMem().getHeapMax().getBytes();\n        if (heapMaxBytes <= 0) {\n            return -1L;\n        }\n        return maxFieldSizeFromNode.calculateValue(ByteSizeValue.ofBytes(heapMaxBytes), null).getBytes();\n    }\n\n    private void checkMaxAttachmentFieldSize(final int fieldSizeBytes) {\n        if (maxFieldSizeFromNodeBytes >= 0 && fieldSizeBytes > maxFieldSizeFromNodeBytes) {\n            if (Strings.hasLength(maxFieldSizeExceededMessage)) {\n                throw new ElasticsearchParseException(\n                    \"field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size {}\",\n                    field,\n                    fieldSizeBytes,\n                    maxFieldSizeExceededMessage\n                );\n            }\n            throw new ElasticsearchParseException(\n                \"field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size of [{}] bytes \"\n                    + \"due to setting [{}={}]\",\n                field,\n                fieldSizeBytes,\n                maxFieldSizeFromNodeBytes,\n                MAX_FIELD_SIZE_SETTING.getKey(),\n                maxFieldSizeFromNode.getStringRep()\n            );\n        }\n        if (maxFieldBytesFromProcessor >= 0 && fieldSizeBytes > maxFieldBytesFromProcessor) {\n            throw new ElasticsearchParseException(","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/AttachmentProcessor.java#L125-L161","documentation":"ElasticsearchParseException from checkMaxAttachmentFieldSize when the raw bytes of the configured attachment field exceed the node-level cap AND the operator has set ingest.attachment.max_field_size_message_suffix. The suffix replaces the default detailed tail, letting operators surface a custom hint (e.g. a documentation link) instead of the raw limit.","triggerScenarios":"An ingest pipeline with an attachment processor receives a document whose source field raw-byte length > maxFieldSizeFromNodeBytes, and ingest.attachment.max_field_size_message_suffix is non-empty. The first branch of checkMaxAttachmentFieldSize fires.","commonSituations":"Large PDFs/Office docs hitting a node heap-relative cap; base64-encoded binaries inflating size; suffix configured to point users at an upload guide.","solutions":["Raise ingest.attachment.max_field_size (absolute bytes or heap ratio) on the node","Reduce the attachment size upstream (extract text before ingest, split documents)","Temporarily clear the suffix setting to see the exact numeric limit for tuning"],"exampleFix":"// before\nPUT _cluster/settings\n{\"persistent\":{\"ingest.attachment.max_field_size\":\"20%\"}}\n// after\nPUT _cluster/settings\n{\"persistent\":{\"ingest.attachment.max_field_size\":\"40%\"}}","handlingStrategy":"validation","validationCode":"// Pre-check field size against the node cap before sending large attachments:\nlong cap = resolveNodeCapBytes(); // from ingest.attachment.max_field_size\nif (rawBytes > cap) { routeToEnrichmentStage(doc); }","typeGuard":null,"tryCatchPattern":"try { ingest(pipeline); }\ncatch (ElasticsearchParseException e) { /* if message contains 'max_field_size_message_suffix' cap, route doc out */ }","preventionTips":["Size the node cap relative to expected document sizes plus headroom","Use the suffix setting to give end users an actionable remediation link","Monitor parse-rejection rates to right-size the cap"],"tags":["ingest","attachment","tika","size-limit","node-setting"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}