Ugh, guess I should shut up now, as I was writing a reply before about be nice to know the actual size of the request/query/doc ingest that caused it, but then saw the request and thought thought that was it.
As in linux OOM, else it's hard to separate or know which are the 'big' ones - OOMs have a score to help with this, but I'm guessing with breakers it's hard to know if the request that trips the breaker is significant or not, or just the last byte that broke the camel/breaker's back. Thus hard to know on a busy system who the bad guys are; always hard on concurrent systems.