Error in text search in ELK

Elastic Stack Elasticsearch
1

I have a problem, I can't do a text search in Elasticsearch. I need to find something like "Text to find". When I try to search, an error occurs.
I tried to change the indices.query.bool.max_clause_count from 1024 to 4096, but that didn't change anything, the error still appears.

{
  "took": 3885,
  "timed_out": false,
  "_shards": {
    "total": 1460,
    "successful": 1459,
    "skipped": 1459,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": "cnv-decision-engine-service-2024.10.16",
        "node": "Tr8hUw05TfirW80ilkWe8A",
        "reason": {
          "type": "query_shard_exception",
          "reason": "failed to create query: field expansion matches too many fields, limit: 1024, got: 2009",
          "index_uuid": "t0e8QD6PQDaEldDqcop7uQ",
          "index": "cnv-decision-engine-service-2024.10.16",
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "field expansion matches too many fields, limit: 1024, got: 2009"
          }
        }
      }
    ]
  },
  "hits": {
    "total": 0,
    "max_score": 0,
    "hits": []
  }
}
2

Hi @Vladimir_Fomin1 :

Your query is hitting too many fields, which is limited by default so the query does not run into memory usage issues.

Can you share the query you're using, and why do you need to search in so many fields?

3

The problem was that I added to elasticsearch.yml indices.query.bool.max_clause_count on the cluster, but did not add it on the nodes on which the index is sharded. After adding it on all necessary nodes, everything worked.

4

No, unfortunately, I was in a hurry. Changing indices.query.bool.max_clause_count: 4096 on nodes where the index is sharded does not solve the problem.

I'm just trying to find something like “Something.”
Response is:

image
image1905×821 54 KB

{
  "took": 3204,
  "timed_out": false,
  "_shards": {
    "total": 1460,
    "successful": 1459,
    "skipped": 1459,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": "cnv-decision-engine-service-2024.10.21",
        "node": "a9m0DuUnR2y_Sd-tRH99ZA",
        "reason": {
          "type": "query_shard_exception",
          "reason": "failed to create query: field expansion matches too many fields, limit: 1024, got: 2963",
          "index_uuid": "R9xJvc7LQ6qWKQ9bAE2tLg",
          "index": "cnv-decision-engine-service-2024.10.21",
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "field expansion matches too many fields, limit: 1024, got: 2963"
          }
        }
      }
    ]
  },
  "hits": {
    "total": 0,
    "max_score": 0,
    "hits": []
  }
}
5

Kibana by default searches across all fields. As that can take a significant amount of memory, the total number of fields that can be used in a query is limited.

You can specify the field(s) you want to search on (using a KQL query like field_name: value) so you don't run into this limitation.

The actual limit depends on the number of search threads and the available heap for the JVM, and is not something that can be otherwise modified. You will need to limit the fields you are querying by specifying them in your query.

6

The thing is, this search was working before -- a couple weeks ago. And it stopped working all of a sudden. I guess the number of fields in the indexes has increased, I don't know exactly.
And if I'm not mistaken, the indices.query.bool.max_clause_count: 4096 parameter is responsible for this limit.
If I change it on the cluster nodes, I should see an error not field expansion matches too many fields, limit: 1024, got: 5961, but field expansion matches too many fields, limit: {{ [4096 in my case] }}, got: 5961
Am I understanding this correctly?

image
image717×585 55.8 KB

7

The number of fields on the indices have increased.

the indices.query.bool.max_clause_count: 4096 parameter is responsible for this limit.

It's a different limit. indices.query.bool.max_clause_count is the maximum number of clauses in a bool query. But the limit you're hitting is the overall number of fields being queried, which is a limit that just depends on the number of search threads and JVM heap memory available. You can't modify this limit via settings, just update your query to target specific fields or reduce the number of fields in your indices.