ElasticSearch cluster coming down when running certain types of wildcard searches

Elastic Stack Elasticsearch
1

We are on ES5 and having some issues figuring the problem is - some type of search queries are completely bringing down elastic search, downtime can range from 5-15 minutes. cluster sometimes stays healthy green and in some times it can very soon turn to Red.

Below are some types are queries which are bringing it down (we convert the search phrases into boolean queries)

  1. 31-2-3*
    below is the boolean query for above which is used to run against ES - anything you see is incorrect?
    {
    "span_near": {
    "clauses": [
    {
    "span_term": {
    "Content": "31"
    }
    },
    {
    "span_term": {
    "Content": "2"
    }
    },
    {
    "span_multi": {
    "match": {
    "wildcard": {
    "Content": "3*"
    }
    }
    }
    }
    ],
    "slop": 0,
    "in_order": true
    }
    }

  2. com* w/5 1205 w/15 reasonable

{
"span_near": {
"clauses": [
{
"span_near": {
"clauses": [
{
"span_multi": {
"match": {
"prefix": {
"Content": "com"
}
}
}
},
{
"span_term": {
"Content": "1205"
}
}
],
"slop": "5",
"in_order": false
}
},
{
"span_term": {
"Content": "reasonable"
}
}
],
"slop": "15",
"in_order": false
}
}

Let us know if you guys find anything incorrect in query generation.

Appreciate your help on this.

2

That's pretty huge, why so large?

3

dont get it search query is below
com* w/5 1205 w/15 reasonable

above is a proximity search in which 1205 has to be with 15 words of reasonable for which slop of 15 has to be added isn't that right?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.