# Entire cluster goes down from single query

**URL:** <https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326>\
**Category:** Elasticsearch\
**Created:** [January 20, 2018, 5:18am UTC](https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326 "2018-01-20T05:18:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Post date:** [January 20, 2018, 5:18am UTC](https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326/1 "2018-01-20T05:18:00Z")

</div>

Not sure how this is possible, but the same query was working fine. We upgraded all our nodes to 6.1.2 and it still seemed to be working but then after a little bit the cluster stopped responding. I couldn't get it to load in the browser either, so I sshed into the server and tried a CURL request there and it worked. I restarted the Elasticsearch services and all the nodes recovered and the health all became green.

Okay, so I try loading our site again, which ran this query, and it instantly goes offline again. Not a single response from the cluster.

I restart them all and they come back. I open Postman and try a GET request. That works. Makes sense. So I try a POST request with a simple match\_all query. Comes back fine. No issues. I try a complicated bigger POST query. Takes a few seconds, but that's pretty fast for what I requested.

Then I try the query our site was running. Postman freezes.

I restart Postman, try it again. Freezes before I can even see the response.

Never seen this before and not sure how / why this is happening. After dissecting the POST request body, it looks like this is the section that causes it.

```
			"aggs": {
				"last_hour": {
					"date_histogram": {
						"field": "date",
						"interval": "minute",
						"format": "date_hour_minute"
					}
				}
			},
```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 20, 2018, 5:18am UTC](https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326/2 "2018-01-20T05:18:38Z")

</div>

> [@arisbanach](#):
>
> "interval": "minute",

How wide of a time frame are you querying across?

---

<div class="post-metadata">

**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Post date:** [January 20, 2018, 5:21am UTC](https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326/3 "2018-01-20T05:21:13Z")

</div>

😅 6 months?

Now that I think about it, I think I had a filter in the query section before, and I removed it thinking I didn't need it...

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 20, 2018, 5:23am UTC](https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326/4 "2018-01-20T05:23:45Z")

</div>

That's 262,800 buckets. That's a lot.

Elasticsearch is going to be trying to calculate these buckets for you and I'd imagine the load on the server would be super high, hence why it looks like it goes down.

---

<div class="post-metadata">

**Author:** ![arisbanach](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Post date:** [January 20, 2018, 5:25am UTC](https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326/5 "2018-01-20T05:25:46Z")

</div>

Makes sense to me. Thanks!

😂 😅 😓 😢

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2018, 5:26am UTC](https://discuss.elastic.co/t/entire-cluster-goes-down-from-single-query/116326/6 "2018-02-17T05:26:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.