I am running a huge aggregation query and getting the following error.
This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the [search.max_buckets] cluster setting or use the [composite] aggregation to paginate all buckets in multiple requests.
This is my query.
{ "aggs": { "projectname": { "terms": { "field": "project.keyword", "order": { "_count": "desc" } },
"aggs": { "username": { "terms": { "field": "user.keyword", "order": { "_count": "desc" } }, "aggs": { "currdir": { "terms": { "field": "CWD.keyword", "order": { "_count": "desc" } },
"aggs": { "reqmem": { "terms": { "field": "reqmem", "order": { "_count": "desc" } },
"aggs": { "reqres": { "terms": { "field": "reqres.keyword", "order": { "_count": "desc" } }, "aggs": { "noproc": { "max": { "field": "no_proc" } }, "mm": { "max": { "field": "max_mem" } }, "avgmem": { "avg": { "field": "max_mem" } }, "rt": { "max": { "field": "run_time" } }, "avgrt": { "avg": { "field": "run_time" } }, "pcm": { "max": { "field": "per_core_memory" } },
"avgpcm": { "avg": { "field": "per_core_memory" } }, "ptime": { "max": { "field": "pend_time" } }, "avgptime": { "avg": { "field": "pend_time" } },
"cputime": { "max": { "field": "ru_utime" } }, "avgcputime": { "avg": { "field": "ru_utime" } } } } } } } } } } } } }, "query": { "bool": { "must": [ { "match_all": {} }, { "match_phrase": { "cluster": { "query": "abc01" } } }, { "match_phrase": { "queue": { "query": "cxx64" } } }, { "range": { "@timestamp": { "gte": "2020-09-01T00:00:00", "lte": "2020-09-30T23:59:59" } } } ] } }
Our ELK admin is not allowing to update the "search.max_buckets" value
Any idea how to fix this ?