From 54902c5363648c8401ce4fe56c0ee3f8d9c7c0c2 Mon Sep 17 00:00:00 2001
From: Seth Grover <seth.d.grover@gmail.com>
Date: Mon, 7 Oct 2024 13:02:20 -0600
Subject: [PATCH] Bump maxmimum fields to 6k

---
 api/project/__init__.py                                | 2 +-
 dashboards/templates/composable/component/zeek.json    | 2 +-
 dashboards/templates/composable/component/zeek_ot.json | 2 +-
 dashboards/templates/malcolm_beats_template.json       | 2 +-
 dashboards/templates/malcolm_template.json             | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/api/project/__init__.py b/api/project/__init__.py
index 4df34047b..15748ebe9 100644
--- a/api/project/__init__.py
+++ b/api/project/__init__.py
@@ -743,7 +743,7 @@ def fields():
             s = SearchClass(
                 using=databaseClient,
                 index=index_from_args(args),
-            ).extra(size=5000)
+            ).extra(size=6000)
             for hit in [x['_source'] for x in s.execute().to_dict().get('hits', {}).get('hits', [])]:
                 if (fieldname := malcolm_utils.deep_get(hit, ['dbField2'])) and (fieldname not in fields):
                     if debugApi:
diff --git a/dashboards/templates/composable/component/zeek.json b/dashboards/templates/composable/component/zeek.json
index 101ccf1ab..1c8b30860 100644
--- a/dashboards/templates/composable/component/zeek.json
+++ b/dashboards/templates/composable/component/zeek.json
@@ -2,7 +2,7 @@
   "template": {
     "settings" : {
       "index" : {
-        "mapping.total_fields.limit" : "5000",
+        "mapping.total_fields.limit" : "6000",
         "mapping.nested_fields.limit" : "250",
         "max_docvalue_fields_search" : "200"
       }
diff --git a/dashboards/templates/composable/component/zeek_ot.json b/dashboards/templates/composable/component/zeek_ot.json
index 6c49c793a..93877c03b 100644
--- a/dashboards/templates/composable/component/zeek_ot.json
+++ b/dashboards/templates/composable/component/zeek_ot.json
@@ -2,7 +2,7 @@
   "template": {
     "settings" : {
       "index" : {
-        "mapping.total_fields.limit" : "5000",
+        "mapping.total_fields.limit" : "6000",
         "mapping.nested_fields.limit" : "250",
         "max_docvalue_fields_search" : "200"
       }
diff --git a/dashboards/templates/malcolm_beats_template.json b/dashboards/templates/malcolm_beats_template.json
index e98ac84e1..31a10a144 100644
--- a/dashboards/templates/malcolm_beats_template.json
+++ b/dashboards/templates/malcolm_beats_template.json
@@ -29,7 +29,7 @@
   "template" :{
     "settings" : {
       "index" : {
-        "mapping.total_fields.limit" : "5000",
+        "mapping.total_fields.limit" : "6000",
         "mapping.nested_fields.limit" : "250",
         "max_docvalue_fields_search" : "200"
       }
diff --git a/dashboards/templates/malcolm_template.json b/dashboards/templates/malcolm_template.json
index dee0b4564..6f4e6ddf8 100644
--- a/dashboards/templates/malcolm_template.json
+++ b/dashboards/templates/malcolm_template.json
@@ -31,7 +31,7 @@
   "template" :{
     "settings" : {
       "index" : {
-        "mapping.total_fields.limit" : "5000",
+        "mapping.total_fields.limit" : "6000",
         "mapping.nested_fields.limit" : "250",
         "max_docvalue_fields_search" : "200"
       }