add highlight max analyzed offset config to avoid long text discover search fail

[iamgd67]

add highlight max analyzed offset config to avoid long text discover search fail resolves #159391

Summary

es default allow 1000000 text highlight anylyzes, if longer than this limit, discover will return fail. it's much better just ignore too long text full highlight than fail the search. so add a config and a default 1000000.

see https://www.elastic.co/guide/en/elasticsearch/reference/7.17/highlighting.html#offsets-strategy

For maintainers

• [ ] This was checked for breaking API changes and was labeled appropriately

[cla-checker-service[bot]]

💚 CLA has been signed

[lukasolson]

Thanks for contributing!

I'm discussing some things internally on how to move forward with this PR, but until then I just wanted to let you know we're actively thinking about this and give some initial feedback:

Having one advanced setting for this specific parameter is probably not what we want moving forward. As you've pointed out, there are other highlight-related parameters that users/admins may want to specifically configure. So we might want to consider changing this to accept a JSON object that can specify multiple parameters. (This is similar to how query:queryString:options works.)

I would hold off on making additional changes on this PR for now, as I'm trying to get the Elasticsearch folks involved as well. What honestly makes most sense to me is to default the max_analyzed_offset value to the same value that is stored in the index settings (index.highlight.max_analyzed_offset). But this change would probably make more sense for Elasticsearch to make rather than at the Kibana level. I could also be missing some context here, so I just want to make sure we're all on the same page.

Again, thanks for contributing... We recognize that the current behavior is not ideal, and we need to do something to help out here.

[lukasolson]

We brought up this need with the Elasticsearch team and they have added https://github.com/elastic/elasticsearch/issues/112822. If they implement this, we can just default to setting it to whatever the index is configured to.

If that is fixed, would you still have a need to configure a value to something different?

[iamgd67]

We brought up this need with the Elasticsearch team and they have added elastic/elasticsearch#112822. If they implement this, we can just default to setting it to whatever the index is configured to.

If that is fixed, would you still have a need to configure a value to something different?

No, I agree that's better. thanks all, I will close this.

[iamgd67]

for thoese who need a workaround, here is a quick and dirty way. tested in docker image kibana:7.17.8, other version should work too. sed -i 's/,fragment_size:m/\0 ,max_analyzed_offset:1000000/' src/plugins/field_formats/target/public/fieldFormats.plugin.js && gzip -k -f src/plugins/field_formats/target/public/fieldFormats.plugin.js