Elastic search is crashing on running multi span query

[vdvc (mastan@netisoftware.com)]

Hi All,
We have noticed an error in using multi span queries. We ran the following query from Kibana interface and noticed that elastic server is consistently crashing. We are having large volume of documents indexed in elastic server.

We are using the elastic search server with version 5.5.2 and Kibana with version 5.5.2

Failed query is

GET _search
{
"size" : 50,
"query" : {
"bool" : {
"must" : [

    {
      "span_near" : {
        "clauses" : [
          {
            "span_term" : {
              "content.content" : {
                "value" : "hello",
                "boost" : 1.0
              }
            }
          },
          {
            "span_multi" : {
              "match" : {
                "regexp" : {
                  "content.content" : {
                    "value" : "[0-9]+[\\.,\\,,0-9]*",
                    "flags_value" : 65535,
                    "max_determinized_states" : 10000,
                    "boost" : 1.0
                  }
                }
              },
              "boost" : 1.0
            }
          }
        ],
        "slop" : 10,
        "in_order" : false,
        "boost" : 1.0
      }
    }
  ],
 
  "disable_coord" : false,
  "adjust_pure_negative" : true,
  "boost" : 1.0
}

}
}

• Thanks for your help advance

[spinscale (Alexander Reelsen)]

can you be more specific what crashes means? Is it unresponsive? Do you have to restart the process? Are there any log files you can share on the node you are hitting?

I assume the culprit is the regex query which might just be super expensive and slows everything down.

Maybe you could explain your use-case so people could search for possible alternatives. Regexes are usually a smell of wrong indexing chains that require fixing on that side...

--Alex