# Get \[parent\] Data too large from kibana logs

**URL:** https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647
**Category:** Kibana
**Created:** [July 16, 2019, 5:39am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647 "2019-07-16T05:39:56Z")
**Posts on this page:** 15
**Page:** 1

<div class="post-metadata">

### Author: ![yuecong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuecong/32/49061_2.png) [@yuecong](https://discuss.elastic.co/u/yuecong)
#### Post date: [July 16, 2019, 5:39am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/1 "2019-07-16T05:39:56Z")

</div>

I get the following error logs and my kibana instance can not load index patterns now. could someone suggest what is happening on this error?

{"type":"error","@timestamp":"2019-07-16T05:35:01Z","tags":,"pid":1,"level":"error","error":{"message":"[parent] Data too large, data for [\<http\_request\>] would be [6106612450/5.6gb], which is larger than the limit of [6103767449/5.6gb], real usage: [6106612040/5.6gb], new bytes reserved: [410/410b]: [circuit\_breaking\_exception] [parent] Data too large, data for [\<http\_request\>] would be [6106612450/5.6gb], which is larger than the limit of [6103767449/5.6gb], real usage: [6106612040/5.6gb], new bytes reserved: [410/410b], with { bytes\_wanted=6106612450 & bytes\_limit=6103767449 & durability="TRANSIENT" }","name":"Error","stack":"[circuit\_breaking\_exception] [parent] Data too large, data for [\<http\_request\>] would be [6106612450/5.6gb], which is larger than the limit of [6103767449/5.6gb], real usage: [6106612040/5.6gb], new bytes reserved: [410/410b], with { bytes\_wanted=6106612450 & bytes\_limit=6103767449 & durability="TRANSIENT" } :: {"path":"/.kibana/\_search","query":{"size":10000,"from":0,"\_source":"index-pattern.title,namespace,type,references,migrationVersion,updated\_at,title","rest\_total\_hits\_as\_int":true},"body":"{\"seq\_no\_primary\_term\":true,\"query\":{\"bool\":{\"filter\":[{\"bool\":{\"should\":[{\"bool\":{\"must\":[{\"term\":{\"type\":\"index-pattern\"}}],\"must\_not\":[{\"exists\":{\"field\":\"namespace\"}}]}}],\"minimum\_should\_match\":1}}]}}}","statusCode":429,"response":"{\"error\":{\"root\_cause\":[{\"type\":\"circuit\_breaking\_exception\",\"reason\":\"[parent] Data too large, data for [\<http\_request\>] would be [6106612450/5.6gb], which is larger than the limit of [6103767449/5.6gb], real usage: [6106612040/5.6gb], new bytes reserved: [410/410b]\",\"bytes\_wanted\":6106612450,\"bytes\_limit\":6103767449,\"durability\":\"TRANSIENT\"}],\"type\":\"circuit\_breaking\_exception\",\"reason\":\"[parent] Data too large, data for [\<http\_request\>] would be [6106612450/5.6gb], which is larger than the limit of [6103767449/5.6gb], real usage: [6106612040/5.6gb], new bytes reserved: [410/410b]\",\"bytes\_wanted\":6106612450,\"bytes\_limit\":6103767449,\"durability\":\"TRANSIENT\"},\"status\":429}"}\n at respond (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:308:15)\n at checkRespForFailure (/usr/share/kibana/node\_modules/elasticsearch/src/lib/transport.js:267:7)\n at HttpConnector. (/usr/share/kibana/node\_modules/elasticsearch/src/lib/connectors/http.js:166:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node\_modules/elasticsearch/node\_modules/lodash/lodash.js:4935:19)\n at IncomingMessage.emit (events.js:194:15)\n at endReadableNT (\_stream\_readable.js:1103:12)\n at process.\_tickCallback (internal/process/next\_tick.js:63:19)"},"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":"?type=index-pattern&fields=title&per\_page=10000","query":{"type":"index-pattern","fields":"title","per\_page":"10000"},"pathname":"/api/saved\_objects/\_find","path":"/api/saved\_objects/\_find?type=index-pattern&fields=title&per\_page=10000","href":"/api/saved\_objects/\_find?type=index-pattern&fields=title&per\_page=10000"},"message":"[parent] Data too large, data for [\<http\_request\>] would be [6106612450/5.6gb], which is larger than the limit of [6103767449/5.6gb], real usage: [6106612040/5.6gb], new bytes reserved: [410/410b]: [circuit\_breaking\_exception] [parent] Data too large, data for [\<http\_request\>] would be [6106612450/5.6gb], which is larger than the limit of [6103767449/5.6gb], real usage: [6106612040/5.6gb], new bytes reserved: [410/410b], with { bytes\_wanted=6106612450 & bytes\_limit=6103767449 & durability="TRANSIENT" }"}

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 16, 2019, 5:44am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/2 "2019-07-16T05:44:44Z")

</div>

Are there any errors in your Elasticsearch logs? What is the output of the [cluster state API](https://www.elastic.co/guide/en/elasticsearch/reference/7.2/cluster-state.html)?

---

<div class="post-metadata">

### Author: ![yuecong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuecong/32/49061_2.png) [@yuecong](https://discuss.elastic.co/u/yuecong)
#### Post date: [July 16, 2019, 5:55am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/3 "2019-07-16T05:55:54Z")

</div>

it is green for the ES cluster.

{  
"cluster\_name" : "logs001",  
"status" : "green",  
"timed\_out" : false,  
"number\_of\_nodes" : 8,  
"number\_of\_data\_nodes" : 3,  
"active\_primary\_shards" : 16,  
"active\_shards" : 33,  
"relocating\_shards" : 0,  
"initializing\_shards" : 0,  
"unassigned\_shards" : 0,  
"delayed\_unassigned\_shards" : 0,  
"number\_of\_pending\_tasks" : 0,  
"number\_of\_in\_flight\_fetch" : 0,  
"task\_max\_waiting\_in\_queue\_millis" : 0,  
"active\_shards\_percent\_as\_number" : 100.0  
}

---

<div class="post-metadata">

### Author: ![yuecong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuecong/32/49061_2.png) [@yuecong](https://discuss.elastic.co/u/yuecong)
#### Post date: [July 16, 2019, 6:06am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/4 "2019-07-16T06:06:30Z")

</div>

hmm. now kibana is back. could you suggest what does that mean in the kibana logs?

I am using Spark ES connector to dump data into the ES cluster, I got the similar error from the spark side as this ticket

> [@How to avoid Data too large error for org.apache.spark.sql.streaming.StreamingQueryException](https://discuss.elastic.co/t/how-to-avoid-data-too-large-error-for-org-apache-spark-sql-streaming-streamingqueryexception/190604):
>
> I am using spark streaming to dump data from Kafka to ES and I got the following errors. org.apache.spark.sql.streaming.StreamingQueryException: Job aborted due to stage failure: Task 6 in stage 4888.0 failed 4 times, most recent failure: Lost task 6.3 in stage 4888.0 (TID 58565, 10.139.64.27, executor 256): org.apache.spark.util.TaskCompletionListenerException: org.elasticsearch.hadoop.rest.EsHadoopRemoteException: circuit\_breaking\_exception: [parent] Data too large, data for [\<http\_request\>]…

But for that one, I can easily work around to restart the spark jobs.  
For this one, just now I had to stop all traffic and cluster is back online.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 16, 2019, 6:15am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/5 "2019-07-16T06:15:00Z")

</div>

It sounds like you are overloading Elasticsearch. What heap size do you have configured for your different nodes? What is the specification of the hosts?

---

<div class="post-metadata">

### Author: ![yuecong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuecong/32/49061_2.png) [@yuecong](https://discuss.elastic.co/u/yuecong)
#### Post date: [July 16, 2019, 6:19am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/6 "2019-07-16T06:19:39Z")

</div>

2 client nodes: 6g java heap, 12GB memory, 2 core CPU  
3 maser nodes : 6g java heap, 12 GB memory, 2 core CPU  
3 data nodes: 16GB Java heap, 32GB memory, 2 core CPU . (1TB ssd attached for each node)

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 16, 2019, 7:03am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/7 "2019-07-16T07:03:19Z")

</div>

What does CPU usage look like on the data nodes when you are indexing and getting these errors? What bulk size are you using? How many concurrent indexing threads?

---

<div class="post-metadata">

### Author: ![yuecong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuecong/32/49061_2.png) [@yuecong](https://discuss.elastic.co/u/yuecong)
#### Post date: [July 16, 2019, 4:26pm UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/8 "2019-07-16T16:26:25Z")

</div>

Thanks for the reply. could you suggest how I can check bulk size and concurrent indexing threads?  
I am going to increase cpu cores first.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 16, 2019, 4:49pm UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/9 "2019-07-16T16:49:40Z")

</div>

That is more of a Spark configuration question so can not help there.

---

<div class="post-metadata">

### Author: ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)
#### Post date: [July 17, 2019, 1:55pm UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/10 "2019-07-17T13:55:37Z")

</div>

What garbage collector are you using? I have observed similar error messages in the monitoring UI when using the G1GC garbage collector.

---

<div class="post-metadata">

### Author: ![yuecong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuecong/32/49061_2.png) [@yuecong](https://discuss.elastic.co/u/yuecong)
#### Post date: [July 17, 2019, 2:01pm UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/11 "2019-07-17T14:01:29Z")

</div>

This is what I get from my ps output

> /opt/jdk-11.0.1/bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFracti

@Magnus_Kessler did you solve your issue by changing GC? Which version of JDK and which GC you would suggest from your observation?

---

<div class="post-metadata">

### Author: ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)
#### Post date: [July 17, 2019, 3:50pm UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/12 "2019-07-17T15:50:12Z")

</div>

I observed the issue in a docker setup, when after I had activated G1GC. The issue disappeared after I switched back to the old standard GC, which you have also active through `-XX:+UseConcMarkSweepGC`. Not sure I can help any further, as your case happens in a different sub-system.

---

<div class="post-metadata">

### Author: ![yuecong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuecong/32/49061_2.png) [@yuecong](https://discuss.elastic.co/u/yuecong)
#### Post date: [July 18, 2019, 3:45pm UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/13 "2019-07-18T15:45:13Z")

</div>

I am using Docker as well, but it is on k8s. I am also testing @Christian_Dahlqvist's suggestion about possible the system is getting overloaded as well.

---

<div class="post-metadata">

### Author: ![esmattdawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/esmattdawson/32/51404_2.png) [@esmattdawson](https://discuss.elastic.co/u/esmattdawson)
#### Post date: [August 1, 2019, 4:56am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/14 "2019-08-01T04:56:43Z")

</div>

The same issue is happening to me.  
I have a server running Kibana 7.3 on OpenJDK11, Aws Ubuntu 18.04 instance with 4GB ram and with 2GB allocated to elasticsearch.  
It is running the marvel monitor on a simple 3 node cluster also running 7.3  
If I just watch the Kibana app monitoring summary screen for a few minutes it kills elasticsearch with the error as per the first poster.

All commands to elasticsearch fail at this point with circuit\_breaking\_exceptions.  
kibana elasticsearch has the following limited indexes at that point.

```auto
green open .monitoring-es-7-2019.08.01 G0mV0MbkTkyenmcbx-_0IA 1 0 2535 1904 2.6mb 2.6mb
green open .kibana_1 N47OPCEaQFyIpX1bn6X86w 1 0 4 0 15.3kb 15.3kb

```

Eventually the server recovers until I look at the screen again at which point it fails.  
The server is completely new install that has only been running for 30 minutes.  
There's practically nothing going on I can't imagine I should be having memory issues.

Making the change Magnus suggests seems to fix the issue.  
i.e. XX:-UseG1GC , XX:+UseConcMarkSweepGC

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2019, 4:56am UTC](https://discuss.elastic.co/t/get-parent-data-too-large-from-kibana-logs/190647/15 "2019-08-29T04:56:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
