**** Best approach for managing high-cardinality dimensions in Elasticsearch?

For logging and observability, I am seeing dimension cardinality blow up with user_id and session_token fields hitting sharding limits. The common answer is to use an enum type or a keyword field with .rewrite, but that doesn't help when the actual cardinality is millions of unique values. Has anyone successfully deployed a solution for this beyond simply using two different indices (one aggregated, one raw)?