elastic/elasticsearch · error · ElasticsearchParseException

field [{}] has an attachment field size of [{}] bytes exceed

Error message

field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size of [{}] bytes due to setting [{}={}]

What it means

Same checkMaxAttachmentFieldSize guard as the suffix variant, but this is the default branch: the node-level max_field_size cap is exceeded and no custom suffix is configured, so the message reports the concrete byte limit and the ingest.attachment.max_field_size setting value that produced it.

Source

Thrown at modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/AttachmentProcessor.java:150

        }
        long heapMaxBytes = JvmInfo.jvmInfo().getMem().getHeapMax().getBytes();
        if (heapMaxBytes <= 0) {
            return -1L;
        }
        return maxFieldSizeFromNode.calculateValue(ByteSizeValue.ofBytes(heapMaxBytes), null).getBytes();
    }

    private void checkMaxAttachmentFieldSize(final int fieldSizeBytes) {
        if (maxFieldSizeFromNodeBytes >= 0 && fieldSizeBytes > maxFieldSizeFromNodeBytes) {
            if (Strings.hasLength(maxFieldSizeExceededMessage)) {
                throw new ElasticsearchParseException(
                    "field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size {}",
                    field,
                    fieldSizeBytes,
                    maxFieldSizeExceededMessage
                );
            }
            throw new ElasticsearchParseException(
                "field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size of [{}] bytes "
                    + "due to setting [{}={}]",
                field,
                fieldSizeBytes,
                maxFieldSizeFromNodeBytes,
                MAX_FIELD_SIZE_SETTING.getKey(),
                maxFieldSizeFromNode.getStringRep()
            );
        }
        if (maxFieldBytesFromProcessor >= 0 && fieldSizeBytes > maxFieldBytesFromProcessor) {
            throw new ElasticsearchParseException(
                "field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed processor size of [{}] bytes",
                field,
                fieldSizeBytes,
                maxFieldBytesFromProcessor
            );
        }
    }

View on GitHub (pinned to db6a809a66)

Solutions

1. Increase ingest.attachment.max_field_size (and ensure the JVM heap supports it)
2. Shrink or pre-process the incoming binary
3. Move heavy attachment parsing out of the ingest pipeline to a dedicated enrichment stage

Example fix

// before: ingest.attachment.max_field_size=-1 resolves against heap and still too small? set an absolute cap
PUT _cluster/settings
{"persistent":{"ingest.attachment.max_field_size":"512mb"}}

long cap = maxFieldSizeFromNodeBytes; // resolved from setting
if (rawBytes > cap) { /* reject upstream or shrink input */ }

try { ingest(pipeline); }
catch (ElasticsearchParseException e) {
    if (e.getMessage().contains("max_field_size")) { /* increase setting or reject doc */ }
    else throw e;
}

When it happens

Trigger: Attachment processor field raw bytes exceed maxFieldSizeFromNodeBytes and maxFieldSizeExceededMessage is empty (Strings.hasLength false). The second throw in checkMaxAttachmentFieldSize fires.

Common situations: Default deployment with large documents; heap-relative cap tighter than expected after a heap resize; ratio value resolving to a smaller absolute number than assumed.

Related errors

• field [{}] has an attachment field size of [{}] bytes exceed
• field [{}] has an attachment field size of [{}] bytes exceed
• Error parsing document in field [{}]
• document is encrypted
• field [{}] is null, cannot parse.

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/26ba52e247295a70. Report an issue: GitHub.