# Cluster instability due to single query inside nested field in aggregation

**URL:** <https://discuss.elastic.co/t/cluster-instability-due-to-single-query-inside-nested-field-in-aggregation/121209>\
**Category:** Elasticsearch\
**Created:** [February 23, 2018, 12:24pm UTC](https://discuss.elastic.co/t/cluster-instability-due-to-single-query-inside-nested-field-in-aggregation/121209 "2018-02-23T12:24:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ultimate.duwal](https://avatars.discourse-cdn.com/v4/letter/u/2acd7d/32.png) [@ultimate.duwal](https://discuss.elastic.co/u/ultimate.duwal)\
**Post date:** [February 23, 2018, 12:24pm UTC](https://discuss.elastic.co/t/cluster-instability-due-to-single-query-inside-nested-field-in-aggregation/121209/1 "2018-02-23T12:24:57Z")

</div>

I am facing a weird issue in a single elasticsearch query causing cluster instability.  
I have a query with filters filters aggregation on a nested field. When I do terms query on the nested field with few values only the query works fine (no impact on cluster) however, if I add many items to the terms query the inside the nested field, then the cluster gets unstable.  
I have a cluster with 4 data nodes and a master node, with 32 gb memory on each nodes.

```
    {
  "size" : 0,
  "aggregations" : {
    "amount" : {
      "terms" : {
        "field" : "user_id",
        "size" : 0
      },
      "aggregations" : {
        "totalAmount" : {
          "nested" : {
            "path" : "amount"
          },
          "aggregations" : {
            "testfilters" : {
              "filter" : {
                "bool" : {
                  "must" : {
                    "bool" : {
                      "must" : [ {
                        "terms" : {
                          **"amount.group" : ["A1", "A2", "A4",..... "A100"]**
                        }
                      } ]
                    }
                  }
                }
              },
              "aggregations" : {
                "paidAmountTotal" : {
                  "sum" : {
                    "field" : "amount.paid"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

```

The above query causes cluster to become unstable. The changes I have done is in above bold text, which is a nested field (amount.group) that I did terms aggregation on.

I have tested with adding match\_all instead of values for amount.group field, though I have no issue with cluster.

How does the terms aggregation in nested field works ?  
What could be cause for this ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2018, 12:24pm UTC](https://discuss.elastic.co/t/cluster-instability-due-to-single-query-inside-nested-field-in-aggregation/121209/2 "2018-03-23T12:24:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.