问题 根据指定字段进行模糊查询，进行查询后报错： {"type":"illegal_argument_exception","reason":"The length of [message] field of [SY_yKc9yQj6HAx8MKMt1pQ] doc of [syslog] index has exceeded [1000000] - maximum allowed to be analyzed for highlighting. This maximum can be set by changing the [index.highlight.max_analyzed_offset] index level setting. For large texts, indexing with offsets or term vectors is recommended!”}}

问题 使用canal向elasticsearch同步数据时，出现： Data too large, data for [<transport_request>] would be [256669646/244.7mb], which is larger than the limit of [255013683/243.1mb], real usage: [256666520/244.7mb], new bytes reserved: [3126/3kb], usages [request=0/0b, fielddata=4812/4.6kb, in_flight_requests=3126/3kb, accounting=6615462/6.3mb]

准备 准备三个elasticsearch节点的配置，放在/etc/elasticsearch/目录下。