Not enough information in indexing errors

Let's take this indexing error for example:

`
2020-11-13T01:00:51.574+02:00 WARN [Messages] Failed to index message: index= id= error=<{"type":"illegal_argument_exception","reason":"Document contains at least one immense term in field=\"StackTrace\" (whose UTF8 encoding is longer than the max length 32766), al
l of which were skipped. Please correct the analyzer to not produce such terms. The prefix of the first immense term is: '[xx, xx, xx, ...., xx, xx]...', original message: bytes can be at most 32766 in
length; got 37305","caused_by":{"type":"max_bytes_length_exceeded_exception","reason":"bytes can be at most 32766 in length; got 37305"}}>
`

The problem is easy resolve if you receive logs only from one source system. All you have to do is to take a look at the logs at the sending end, and probably truncate the offending field.

However, if you are using Graylog for centralized logging of several different systems the aforementioned is untenable. The first a few characters of the message are likely not enough to even figure out what system causes the issue. Different systems have probably different teams working on them. Asking everyone and doing some research takes time and resources. It's a genuine nuisance when trying to maintain a larger setup.

Efficient solution would be simple. Add the IP addresses of the servers sending the messages (who contacted the input), and at indexing error print that on the logs! It would help greatly bracketing and resolving the indexing issue.