I launched the next query:
{
"from" : 0,
"size" : 0,
"query" : {
"bool" : {
"must" : {
"match_all" : { }
},
"filter" : {
"bool" : {
"must" : {
"range" : {
"fireEventDate" : {
"from" : "2016-10-04T00:00:00.000+02:00",
"to" : "2016-10-05T00:00:00.000+02:00",
"include_lower" : true,
"include_upper" : false
}
}
}
}
}
}
},
"aggregations" : {
"agg" : {
"terms" : {
"field" : "ipSrc",
"size" : 10,
"order" : {
"_count" : "asc"
}
},
"aggregations" : {
"count_agg" : {
"terms" : {
"field" : "host"
}
}
}
}
}
}
This is one day query over one index:
health status index pri rep docs.count docs.deleted store.size pri.store.size
green open http.2016.10.04.00 4 1 39440891 0 13.8gb 6.9gb
I have 1597702 of distinct IP and 86561 of distinct host. I have 4 nodes with 8GB of heap for each one.
After 10 minutes the cluster becames red.
Is the problem the length of the result??, I'm using size" : 10
Thanks again!