elastic/elasticsearch · error · ElasticsearchParseException

field [{}] has an attachment field size of [{}] bytes exceed

Error message

field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed processor size of [{}] bytes

What it means

ElasticsearchParseException when the per-processor cap (max_field_bytes in the attachment processor configuration) is set to >= 0 and the field's raw bytes exceed it. This is independent of, and in addition to, the node-level max_field_size cap — whichever is stricter wins.

Source

Thrown at modules/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/AttachmentProcessor.java:161

                throw new ElasticsearchParseException(
                    "field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size {}",
                    field,
                    fieldSizeBytes,
                    maxFieldSizeExceededMessage
                );
            }
            throw new ElasticsearchParseException(
                "field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed input size of [{}] bytes "
                    + "due to setting [{}={}]",
                field,
                fieldSizeBytes,
                maxFieldSizeFromNodeBytes,
                MAX_FIELD_SIZE_SETTING.getKey(),
                maxFieldSizeFromNode.getStringRep()
            );
        }
        if (maxFieldBytesFromProcessor >= 0 && fieldSizeBytes > maxFieldBytesFromProcessor) {
            throw new ElasticsearchParseException(
                "field [{}] has an attachment field size of [{}] bytes exceeding the maximum allowed processor size of [{}] bytes",
                field,
                fieldSizeBytes,
                maxFieldBytesFromProcessor
            );
        }
    }

    boolean isIgnoreMissing() {
        return ignoreMissing;
    }

    // For tests only
    boolean isRemoveBinary() {
        return removeBinary;
    }

    // For tests only

View on GitHub (pinned to db6a809a66)

Solutions

1. Raise the max_field_bytes value in the processor config (PUT _ingest/pipeline)
2. Filter oversized documents before they reach this pipeline
3. Set max_field_bytes to -1 to rely solely on the node-level cap

Example fix

// before
PUT _ingest/pipeline/attach
{"processors":[{"attachment":{"field":"data","max_field_bytes":10485760}}]}
// after
{"processors":[{"attachment":{"field":"data","max_field_bytes":52428800}}]}

// Enforce the per-processor cap on the client side:
int cap = processorConfig.max_field_bytes;
if (cap >= 0 && doc.fieldRawBytes > cap) { rejectOrRoute(doc); }

try { ingest(pipeline); }
catch (ElasticsearchParseException e) {
    if (e.getMessage().contains("maximum allowed processor size")) { /* raise cap or shrink input */ }
    else throw e;
}

When it happens

Trigger: Pipeline defines the attachment processor with a numeric max_field_bytes and a document's field raw bytes exceed it. The second if-branch in checkMaxAttachmentFieldSize triggers (after the node-level check passes).

Common situations: Per-pipeline guard tighter than node default; different pipelines for different document classes with distinct budgets; mis-typed byte value.

Related errors

• field [{}] has an attachment field size of [{}] bytes exceed
• field [{}] has an attachment field size of [{}] bytes exceed
• field [{}] is null, cannot parse.
• Error parsing document in field [{}]
• document is encrypted

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/740681e93953612b. Report an issue: GitHub.