# Aggregation with filters causing OutOfMemoryError

**URL:** <https://discuss.elastic.co/t/aggregation-with-filters-causing-outofmemoryerror/24738>\
**Category:** Elasticsearch\
**Created:** [July 1, 2015, 2:57pm UTC](https://discuss.elastic.co/t/aggregation-with-filters-causing-outofmemoryerror/24738 "2015-07-01T14:57:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kufi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kufi/32/3539_2.png) [@kufi](https://discuss.elastic.co/u/kufi)\
**Post date:** [July 1, 2015, 2:57pm UTC](https://discuss.elastic.co/t/aggregation-with-filters-causing-outofmemoryerror/24738/1 "2015-07-01T14:57:14Z")

</div>

Hello

We currently have a problem with one of our queries, but only in specific circumstances. Basically, the query runs without problems as long as the amount of filters is not really big. This is ok for most of our queries, but one specific query generates around 3000 filter buckets which cause an OutOfMemoryError. Lower numbers of buckets are okay and also perform fast enough on the amount of documents we currently store.

Is there a way to prevent this?

The query looks like this:

```
{
    {
        "filtered": {
            "filter": {
                "and": [
                    {
                        "nested": {
                            "path": "tags",
                            "filter": {
                                ...
                            }
                        }
                    },
                    {
                        "term": {
                            "field": value
                        }
                    }
                ]
            }
        }
    },
    "aggs": {
        "distribution": {
            "filters": {
                "filters": {
                    "filter_one": {
                        "nested": {
                            "path": "tags",
                            "filter": {
                                ...
                            }
                        }
                    },
                    ...more filters here, same structure as above. If too many filter buckets present, the query crashes
                }
            },
            "aggs": {
                "timeline": {
                    "nested": {
                        "path": "nested"
                    },
                    "aggs": {
                        "timeline_filter": {
                            "filter": {
                                ...
                            },
                            "aggs": {
                                "timeline_histogram": {
                                    "date_histogram": {
                                        "field": "nested.created_at",
                                        "interval": "day"
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 2, 2015, 2:45am UTC](https://discuss.elastic.co/t/aggregation-with-filters-causing-outofmemoryerror/24738/2 "2015-07-02T02:45:12Z")

</div>

Add more heap or reduce your bucket count is about it unfortunately.

---

<div class="post-metadata">

**Author:** ![kufi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kufi/32/3539_2.png) [@kufi](https://discuss.elastic.co/u/kufi)\
**Post date:** [July 2, 2015, 1:28pm UTC](https://discuss.elastic.co/t/aggregation-with-filters-causing-outofmemoryerror/24738/3 "2015-07-02T13:28:27Z")

</div>

Ok. Good to know, because I ran out of ideas besides the "more power" route.

I'm thinking about splitting the buckets up into multiple requests and patching the results together after that, as the end results itself are quite easy to combine.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 2, 2015, 9:32pm UTC](https://discuss.elastic.co/t/aggregation-with-filters-causing-outofmemoryerror/24738/4 "2015-07-02T21:32:31Z")

</div>

That's definitely another viable option if you can.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:03am UTC](https://discuss.elastic.co/t/aggregation-with-filters-causing-outofmemoryerror/24738/5 "2017-07-06T00:03:53Z")

</div>