# Action.search.shard\_count.limit exceeded

**URL:** <https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891>\
**Category:** Elasticsearch\
**Created:** [October 13, 2016, 5:47am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891 "2016-10-13T05:47:56Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hamsaraj](https://avatars.discourse-cdn.com/v4/letter/h/5e9695/32.png) [@Hamsaraj](https://discuss.elastic.co/u/Hamsaraj)\
**Post date:** [October 13, 2016, 5:47am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/1 "2016-10-13T05:47:56Z")

</div>

Can someone please help locate the file containing this parameter  
**action.search.shard\_count.limit**

I trying to parse a single log file of around 3.2 GB using ELK stack. The same has got indexed and when I am trying to discover indexed logs in Kibana I get the following error.

Error: Discover: Trying to query 2051 shards, which is over the limit of 1000. This limit exists because querying many shards at the same time can make the job of the coordinating node very CPU and/or memory intensive. It is usually a better idea to have a smaller number of larger shards. Update [action.search.shard\_count.limit] to a greater value if you really want to query that many shards at the same time.

This is just a test setup and I am using ElasticSearch 5.0 beta version for this setup.

---

<div class="post-metadata">

**Author:** ![wanglifengwf](https://avatars.discourse-cdn.com/v4/letter/w/41988e/32.png) [@wanglifengwf](https://discuss.elastic.co/u/wanglifengwf)\
**Post date:** [October 13, 2016, 5:55am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/2 "2016-10-13T05:55:16Z")

</div>

you can reduce the index shards!

---

<div class="post-metadata">

**Author:** ![Hamsaraj](https://avatars.discourse-cdn.com/v4/letter/h/5e9695/32.png) [@Hamsaraj](https://discuss.elastic.co/u/Hamsaraj)\
**Post date:** [October 13, 2016, 6:21am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/3 "2016-10-13T06:21:51Z")

</div>

Thanks. Can you please guide how this can be done.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 13, 2016, 7:32am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/4 "2016-10-13T07:32:59Z")

</div>

It's set in `elasticsearch.yml`.

---

<div class="post-metadata">

**Author:** ![Hamsaraj](https://avatars.discourse-cdn.com/v4/letter/h/5e9695/32.png) [@Hamsaraj](https://discuss.elastic.co/u/Hamsaraj)\
**Post date:** [October 13, 2016, 8:56am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/5 "2016-10-13T08:56:57Z")

</div>

Dont think so Mark. With ElasticSearch 5.0 version they have decoupled these settings from .yml file.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 13, 2016, 9:49am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/6 "2016-10-13T09:49:02Z")

</div>

How much data do you have in the cluster? How many shards in total?

The check is there for a reason, so unless you have a very large amount of data in your cluster and the average shard size is over a few GB, I would recommend looking into reducing the number of shards even if it is just a test system.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 13, 2016, 9:52am UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/7 "2016-10-13T09:52:58Z")

</div>

Well we're both wrong 😛  
It's a cluster level setting, so `_cluster/settings`.

[https://www.elastic.co/guide/en/elasticsearch/reference/5.0/search-search.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.0/search-search.html)

---

<div class="post-metadata">

**Author:** ![rpoveda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rpoveda/32/12556_2.png) [@rpoveda](https://discuss.elastic.co/u/rpoveda)\
**Post date:** [March 29, 2017, 3:42pm UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/8 "2017-03-29T15:42:15Z")

</div>

😑........

This is the way to change the "shard\_count" limit in searches on clusters settings:

```
curl -u admin:admin -XPUT 'https://localhost:9200/_cluster/settings' -H 'Content-Type: application/json' -d' 
{
    "persistent" : {
        "action.search.shard_count.limit" : "1500"
    }
}
'

```

-u admin:admin (authenticated for user: admin, password: admin)  
https (only on clusters with ssl in rest layer)

[https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-update-settings.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-update-settings.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:01pm UTC](https://discuss.elastic.co/t/action-search-shard-count-limit-exceeded/62891/9 "2017-07-05T22:01:46Z")

</div>