kibana use discover search 'error' occur error 'The content length (1026706026) is bigger than the maximum allowed string (536870888)'

[lishuaisky]

**Kibana version: 7.17.8 7.17.15 7.17.16

**Elasticsearch version: 7.17.8

**Server OS version: aws linux 2023

**Browser version: chrome 119.0.6045.200 64 bit

**Browser OS version: window 11

**Original install method (e.g. download page, yum, from source, etc.): download
https://artifacts.elastic.co/downloads/kibana/kibana-7.17.8-linux-x86_64.tar.gz
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.8-linux-x86_64.tar.gz
**Describe the bug:
In kibana discover UI,search 'error' keyword. it occur error 'The content length (1026706026) is bigger than the maximum allowed string (536870888)'. But search other keyword,such as 'info' 'warn', it works

Steps to reproduce:
1.Open kibana url in browser
2.launch discover and search 'error'
3. It occur error 'The content length (1026706026) is bigger than the maximum allowed string (536870888)'

**Expected behavior:
search works

Screenshots (if relevant):

Errors in browser console (if relevant):
kibana-1702525043083.log

Provide logs and/or server output (if relevant):
elasticsearch and kibana have no error log
**Any additional context:
elasticsearch config:
cluster.name: es-log-cluster
node.name: log-es-node-1
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch
http.port: 9200
network.host: 0.0.0.0
discovery.zen.ping.unicast.hosts: ["log-es-node-1","log-es-node-2","log-es-node-3"]
cluster.initial_master_nodes: ["log-es-node-1","log-es-node-2","log-es-node-3"]
node.data: true
node.master: true
http.cors.enabled: true
http.cors.allow-origin: "*"
cluster.routing.allocation.enable: "all"
cluster.routing.rebalance.enable: "all"
cluster.routing.allocation.disk.watermark.high: "90%"
cluster.routing.allocation.disk.watermark.low: "85%"
ingest.geoip.downloader.enabled: false
path.repo: /data/es_snapshot
kibana config:
i18n.locale: "zh-CN"
migrations.batchSize: 100000
migrations.maxBatchSizeBytes: 1000000000
savedObjects.maxImportExportSize: 100000
savedObjects.maxImportPayloadBytes: 10000000000
server.maxPayload: 10000000000

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[jughosta]

Most probably some of the documents, which match "error" query, have large field values.

Would it help to add such fields as "Field filter" from Stack Management > Index Patterns > "broker-server*" page ("Field filters" tab)? Then Discover would not request them.

[davismcphee]

Thanks for reporting, but I'm going to close this issue since it isn't directly related to Discover and results from having very large field values in documents. The workaround suggested by @jughosta can be applied to filter out the oversized fields in Kibana, and should prevent the error from occurring in Discover.

Also linking to a related issue #98497, although it was put in our icebox for now as it seems unlikely we will make any changes related to this in the near term.