Limit the value in prefix query

[mayya-sharipova]

Description

Prefix queries with a huge values can lead to OOM. Limit the maximum length of the value to be submitted.

[elasticsearchmachine]

Pinging @elastic/es-search (Team:Search)

[YahelyUshpiz]

working on it

[benwtrent]

We need to determine what a "huge value" means.

Additionally, I am not 100% sure we want to simply disable this for all users. If we blindly reject query prefixes we think are "large", it would break existing behavior (e.g. user's who expect a query to work now has their query always fail with no recourse).

Maybe there should be a setting indicating the allowed prefix size or if "large" prefixes are allowed?

We cannot use the setting search.allow_expensive_queries to indicate if large prefixes are allowed or not, as its already used to determine if prefix queries themselves are allowed.

[mayya-sharipova]

It is reasonable to have a limit of 1000.

I suggest we reuse the setting index.max_regex_length and update the documentation saying that this setting also applies to prefix queries (and may be also wildcard queries?).

@benwtrent What do you think?

[benwtrent]

@mayya-sharipova I think using index.max_regex_length is a good idea. Default of 1k is prudent.