At the moment varnishlog consumers (i.e. varnishfetcherr, varnishslowlog, varnishtlsinspector, varnishhospital) will log all request/response headers as individual fields as key: value. Since there's a lot of custom/user-controller headers in the wild and each header gets indexed in elasticsearch as a separate field, we've seen "fields explosion" problems where we hit elasticsearch's per-index limits. See also T180051 for more context on this problem.

A potential solution would be to have a whitelisted set of request/response headers to send as individual fields, and consolidate the rest into e.g. request_headers and response_headers fields.