# Error in text search in ELK
**URL:** https://discuss.elastic.co/t/error-in-text-search-in-elk/368946
**Category:** Elasticsearch
**Created:** [October 16, 2024, 8:54pm UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946 "2024-10-16T20:54:48Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Vladimir\_Fomin1](https://discuss.elastic.co/u/Vladimir_Fomin1)
#### Post date: [October 16, 2024, 8:54pm UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946/1 "2024-10-16T20:54:48Z")
I have a problem, I can't do a text search in Elasticsearch. I need to find something like "Text to find". When I try to search, an error occurs.
I tried to change the indices.query.bool.max\_clause\_count from 1024 to 4096, but that didn't change anything, the error still appears.
```auto
{
"took": 3885,
"timed_out": false,
"_shards": {
"total": 1460,
"successful": 1459,
"skipped": 1459,
"failed": 1,
"failures": [
{
"shard": 0,
"index": "cnv-decision-engine-service-2024.10.16",
"node": "Tr8hUw05TfirW80ilkWe8A",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: field expansion matches too many fields, limit: 1024, got: 2009",
"index_uuid": "t0e8QD6PQDaEldDqcop7uQ",
"index": "cnv-decision-engine-service-2024.10.16",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "field expansion matches too many fields, limit: 1024, got: 2009"
}
}
}
]
},
"hits": {
"total": 0,
"max_score": 0,
"hits": []
}
}
```
---
### Author:  [@Carlos\_D](https://discuss.elastic.co/u/Carlos_D)
#### Post date: [October 17, 2024, 11:28am UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946/2 "2024-10-17T11:28:41Z")
Hi @Vladimir_Fomin1 :
Your query is hitting too many fields, which is limited by default so the query does not run into memory usage issues.
Can you share the query you're using, and why do you need to search in so many fields?
---
### Author:  [@Vladimir\_Fomin1](https://discuss.elastic.co/u/Vladimir_Fomin1)
#### Post date: [October 18, 2024, 6:20am UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946/3 "2024-10-18T06:20:07Z")
The problem was that I added to elasticsearch.yml _indices.query.bool.max\_clause\_count_ on the cluster, but did not add it on the nodes on which the index is sharded. After adding it on all necessary nodes, everything worked.
---
### Author:  [@Vladimir\_Fomin1](https://discuss.elastic.co/u/Vladimir_Fomin1)
#### Post date: [October 21, 2024, 8:43am UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946/4 "2024-10-21T08:43:36Z")
No, unfortunately, I was in a hurry. Changing indices.query.bool.max\_clause\_count: 4096 on nodes where the index is sharded does not solve the problem.
I'm just trying to find something like “Something.”
Response is:
```auto
{
"took": 3204,
"timed_out": false,
"_shards": {
"total": 1460,
"successful": 1459,
"skipped": 1459,
"failed": 1,
"failures": [
{
"shard": 0,
"index": "cnv-decision-engine-service-2024.10.21",
"node": "a9m0DuUnR2y_Sd-tRH99ZA",
"reason": {
"type": "query_shard_exception",
"reason": "failed to create query: field expansion matches too many fields, limit: 1024, got: 2963",
"index_uuid": "R9xJvc7LQ6qWKQ9bAE2tLg",
"index": "cnv-decision-engine-service-2024.10.21",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "field expansion matches too many fields, limit: 1024, got: 2963"
}
}
}
]
},
"hits": {
"total": 0,
"max_score": 0,
"hits": []
}
}
```
---
### Author:  [@Carlos\_D](https://discuss.elastic.co/u/Carlos_D)
#### Post date: [October 21, 2024, 7:07pm UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946/5 "2024-10-21T19:07:02Z")
Kibana by default searches across all fields. As that can take a significant amount of memory, the total number of fields that can be used in a query is limited.
You can specify the field(s) you want to search on (using a [KQL query](https://www.elastic.co/guide/en/kibana/current/kuery-query.html) like `field_name: value`) so you don't run into this limitation.
The actual limit depends on the number of search threads and the available heap for the JVM, and is not something that can be otherwise modified. You will need to limit the fields you are querying by specifying them in your query.
---
### Author:  [@Vladimir\_Fomin1](https://discuss.elastic.co/u/Vladimir_Fomin1)
#### Post date: [October 22, 2024, 8:13am UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946/6 "2024-10-22T08:13:19Z")
The thing is, this search was working before -- a couple weeks ago. And it stopped working all of a sudden. I guess the number of fields in the indexes has increased, I don't know exactly.
And if I'm not mistaken, the indices.query.bool.max\_clause\_count: 4096 parameter is responsible for this limit.
If I change it on the cluster nodes, I should see an error not field expansion matches too many fields, limit: 1024, got: 5961, but field expansion matches too many fields, limit: `{{ [4096 in my case] }}`, got: 5961
Am I understanding this correctly?
---
### Author:  [@Carlos\_D](https://discuss.elastic.co/u/Carlos_D)
#### Post date: [October 22, 2024, 11:54am UTC](https://discuss.elastic.co/t/error-in-text-search-in-elk/368946/7 "2024-10-22T11:54:12Z")
> [@Vladimir\_Fomin1](#):
>
> this search was working before -- a couple weeks ago. And it stopped working all of a sudden. I guess the number of fields in the indexes has increased, I don't know exactly.
The number of fields on the indices have increased.
> the indices.query.bool.max\_clause\_count: 4096 parameter is responsible for this limit.
It's a different limit. `indices.query.bool.max_clause_count` is the maximum number of clauses in a `bool` query. But the limit you're hitting is the overall number of fields being queried, which is a limit that just depends on the number of search threads and JVM heap memory available. You can't modify this limit via settings, just update your query to target specific fields or reduce the number of fields in your indices.