Discover: Result window is too large, from + size must be less than or equal to: [10000]

[sandeepkanabar]

Hi All,

In an ES 6.8.6 cluster, I created an index pattern in Kibana and when I went to discover tab, I got the error

Discover: Result window is too large, from + size must be less than or equal to: [10000] but was [200000]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max_result_window] index level setting

1. The indices are huge containing millions of docs. But how am I supposed to set scroll in Kibana? Also, I don't remember seeing this error when using Kibana 5.x.

2. Should I set index.max_result_window? Any caveats?

3. Why does Kibana GUI keep repeating the same error n times as seen in the above screenshot?

Will appreciate some pointers.

Thanks.

[Grim (Patrick)]

Hi,
generally it is not advisable to have a search query returning more than 10000 documents. I suggest you use a query which narrows down your result to at least a few hundred. Apart from the result limit, in the discover tab you also have a default limit of (I think) 500 results to display.

In case you want to search more than those 10000 documents you should use the scroll API as suggested in the error message.

You can also change the index.max_result_window but this is NOT advised

Hope this helps

[sandeepkanabar]

Thanks Patrick. But I am not firing any query. Just created an index-pattern in Kibana pointing to single index (which has millions of docs) and then went to discover tab and selected the index pattern. Kibana fires the underlying query. Just to make it clear - I'm in Kibana GUI.

[sandeepkanabar]

The fix was pretty simple. In Kibana GUI, Management --> Kibana --> Advanced Settings and then reduce the value of Number of rows from 200000 to 10000.