Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Increase url.query ignore_above value to 2083 #2424

Merged
merged 6 commits into from
Jan 20, 2025

Conversation

mjwolf
Copy link
Contributor

@mjwolf mjwolf commented Jan 15, 2025

Increasing the url.query ignore_above value will allow indexing longer query values which have been observed.

2083 is used because it will cover the maximum url length for Chrome (2048) and Internet Explorer (2083).

Other browsers and web servers support longer URLs, and there is no absolute URL limit defined in any RFC. So higher values could be possible, supporting Chrome's maximum length will allow compatibility with the most common browser, while not increasing the index size too much.

  • Have you signed the contributor license agreement? y
  • Have you followed the contributor guidelines? y
  • For proposing substantial changes or additions to the schema, have you reviewed the RFC process? n/a
  • If submitting code/script changes, have you verified all tests pass locally using make test? y
  • If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes?
  • Is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed. y
  • Have you added an entry to the CHANGELOG.next.md? y

closes #105

Increasing the url.query ignore_above value will allow indexing longer
query values which have been observed.

2083 is used because it will cover the maximum url length for Chrome
(2048) and Internet Explorer (2083).

Other browsers and web servers support longer URLs, and there is no
absolute URL limit defined in any RFC. So higher values could be
possible, supporting Chrome's maximum length will allow compatibility
with the most common browser, while not increasing the index size too much.
@mjwolf mjwolf requested a review from a team as a code owner January 15, 2025 21:29
Copy link

@qcorporation qcorporation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please add event.url to the change. otherwise looks great!

@mjwolf
Copy link
Contributor Author

mjwolf commented Jan 20, 2025

please add event.url to the change. otherwise looks great!

I've made that change

@mjwolf mjwolf merged commit 7cf862e into elastic:main Jan 20, 2025
3 checks passed
mjwolf added a commit to mjwolf/ecs that referenced this pull request Jan 20, 2025
Increasing the url.query ignore_above value will allow indexing longer query values which have been observed.

2083 is used because it will cover the maximum url length for Chrome (2048) and Internet Explorer (2083).

Other browsers and web servers support longer URLs, and there is no absolute URL limit defined in any RFC. So higher values could be possible, supporting Chrome's maximum length will allow compatibility with the most common browser, while not increasing the index size too much.
mjwolf added a commit that referenced this pull request Jan 21, 2025
Increasing the url.query ignore_above value will allow indexing longer query values which have been observed.

2083 is used because it will cover the maximum url length for Chrome (2048) and Internet Explorer (2083).

Other browsers and web servers support longer URLs, and there is no absolute URL limit defined in any RFC. So higher values could be possible, supporting Chrome's maximum length will allow compatibility with the most common browser, while not increasing the index size too much.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Increasing of ignore_above for keyword
2 participants