# ES aggregation query
**URL:** https://discuss.elastic.co/t/es-aggregation-query/253284
**Category:** Elasticsearch
**Created:** [October 26, 2020, 9:36am UTC](https://discuss.elastic.co/t/es-aggregation-query/253284 "2020-10-26T09:36:34Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)
#### Post date: [October 26, 2020, 9:36am UTC](https://discuss.elastic.co/t/es-aggregation-query/253284/1 "2020-10-26T09:36:34Z")
I am running a huge aggregation query and getting the following error.
_This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the [search.max\_buckets] cluster setting or use the [composite] aggregation to paginate all buckets in multiple requests._
This is my query.
```auto
{ "aggs": { "projectname": { "terms": { "field": "project.keyword", "order": { "_count": "desc" } },
"aggs": { "username": { "terms": { "field": "user.keyword", "order": { "_count": "desc" } }, "aggs": { "currdir": { "terms": { "field": "CWD.keyword", "order": { "_count": "desc" } },
"aggs": { "reqmem": { "terms": { "field": "reqmem", "order": { "_count": "desc" } },
"aggs": { "reqres": { "terms": { "field": "reqres.keyword", "order": { "_count": "desc" } }, "aggs": { "noproc": { "max": { "field": "no_proc" } }, "mm": { "max": { "field": "max_mem" } }, "avgmem": { "avg": { "field": "max_mem" } }, "rt": { "max": { "field": "run_time" } }, "avgrt": { "avg": { "field": "run_time" } }, "pcm": { "max": { "field": "per_core_memory" } },
"avgpcm": { "avg": { "field": "per_core_memory" } }, "ptime": { "max": { "field": "pend_time" } }, "avgptime": { "avg": { "field": "pend_time" } },
"cputime": { "max": { "field": "ru_utime" } }, "avgcputime": { "avg": { "field": "ru_utime" } } } } } } } } } } } } }, "query": { "bool": { "must": [{ "match_all": {} }, { "match_phrase": { "cluster": { "query": "abc01" } } }, { "match_phrase": { "queue": { "query": "cxx64" } } }, { "range": { "@timestamp": { "gte": "2020-09-01T00:00:00", "lte": "2020-09-30T23:59:59" } } }] } }
```
Our ELK admin is not allowing to update the "search.max\_buckets" value
Any idea how to fix this ?
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [October 26, 2020, 10:18am UTC](https://discuss.elastic.co/t/es-aggregation-query/253284/2 "2020-10-26T10:18:10Z")
Can you provide some more details?
- elasticsearch version?
- according to your query you need `project * user * cwd * reqmem * reqres` buckets, I guess that's way more than 10k, do you have an idea how many buckets this requires? Afaik aggs stop as soon as they overflow, therefore its more than `10001`
- how often do you intend to run this query?
- what do you intend to do with the result?
As the error message says, use a [composite aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-composite-aggregation.html). If you want to do further analysis based on the output of the query, you should consider [transform](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html), which is basically a composite aggregation that stores the result as documents. Your query lets me think, you want to have monthly buckets in addition to the groupings.
---
### Author:  [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)
#### Post date: [October 26, 2020, 11:01am UTC](https://discuss.elastic.co/t/es-aggregation-query/253284/3 "2020-10-26T11:01:20Z")
Thanks Hendrik.
Here are the details:
1- Elastic version : 6.2.4
2- No of buckets: ~40k
3- Frequency to run the query: 1-2 times in a week
4- Collect the data and analyze the workliad
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [October 26, 2020, 11:26am UTC](https://discuss.elastic.co/t/es-aggregation-query/253284/4 "2020-10-26T11:26:04Z")
In this case composite aggregation is your best option.
With new versions this might get easier:
- transform `>= 7.5`
- `search.max_buckets` default to 65k `>= 7.9`
---
### Author:  [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)
#### Post date: [October 26, 2020, 12:05pm UTC](https://discuss.elastic.co/t/es-aggregation-query/253284/5 "2020-10-26T12:05:22Z")
Can you guide me how to implement composite aggregation.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2020, 12:05pm UTC](https://discuss.elastic.co/t/es-aggregation-query/253284/6 "2020-11-23T12:05:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.