[bug]There seems to be a problem that blacklist can only be specified up to 1024, so the document needs to be updated

[nsano-rururu]

whitelist may have similar issues

Yelp/elastalert#1867 (comment)

I didn't realize there was a limit of 1024, thanks so much for the info. It's definitely possible to use terms.

The only "problem" with terms is that you now need to know if the field is analyzed or not, which confuses a lot of people and is hard to have good defaults for. IE, in elasticsearch <5, if using logstash, you add .raw, in >=5, it's .keyword. If using a custom index it could be something else.

IF the 1024 limit is per single query, we might also just be able to split it up into groups of 1024 query string queries. I'd be interested to know what the performance of terms versus query string is for large numbers. I assume query string is worse, but I don't know by how much.