ES日志报错赏析-trying to create too many buckets

报错现象

trying to create too many buckets. must be less than or equal to: [100000] but was [100001]. this limit can be set by changing the [search.max_buckets] cluster level setting.
复制

报错解析

聚集桶默认为10000，查询超过的时候，就会报错，导致查询失败。

由于Bucket aggregations查询操作比较消耗内存，如果聚集桶过多，频率较大时，很容易导致集群JVM内存不足，进而产生查询熔断。这里建议出现此问题后及时进行业务查询的整改，临时可通过如下解决方案进行临时放开限制。

解决方案

1-调整集群最大聚集桶配置，临时解决问题

PUT _cluster/settings
{
  "persistent": {
    "search.max_buckets": 11000
  }
}

官网文档参考：

https://www.elastic.co/guide/en/elasticsearch/reference/7.16/search-settings.html#search-settings-max-buckets