Es log error appreciation -trying to create too many buckets

Error reporting

trying to create too many buckets. must be less than or equal to: [100000] but was [100001]. this limit can be set by changing the [search.max_buckets] cluster level setting.
 Copy 

Copy

Error reporting analysis

The aggregation bucket defaults to 10000, When the query exceeds , You're going to report a mistake , Cause the query to fail .

because Bucket aggregations Query operation consumes more memory , If there are too many buckets , When the frequency is high , It is easy to cause clustering JVM Out of memory , And then generate query fuse . It is suggested to rectify the business query in time after this problem occurs , The following solutions can be used to temporarily release restrictions .

Solution

1- Adjust the configuration of the cluster's maximum aggregation bucket , Solve the problem temporarily

PUT _cluster/settings
{
  "persistent": {
    "search.max_buckets": 11000
  }
}

Copy

Official website document reference ：

https://www.elastic.co/guide/en/elasticsearch/reference/7.16/search-settings.html#search-settings-max-buckets