Getting runtime_exception exceeds maxClauseCount after Elasticsearch upgrade

[gwillis (Geoffrey Willis)]

We are upgrading from Elasticsearch 6.2.4 to Elasticsearch 8.4.1 and are experiencing problems with several queries getting a runtime_exception exceeds maxClauseCount. Elasticsearch 6.2.4 uses the default for index.query.bool.max_clause_count. Elasticsearch 8.4.1 has indices.query.bool.max_clause_count: 64480 in elasticsearch.yml, however it looks like it is overridden based on heap size.

Here is an example of a query that is having the problem, ft0030 is an author field searching for last name, and first names that start with the first letter of the first name:

GET /tol/_search
{
"query": 
{
    "span_near": {
        "clauses": [
            {
                "span_term": {
                    "ft0030": {
                        "value": "shaw"
                    }
                }
            },
            {
                "span_multi": {
                    "match": {
                        "wildcard": {
                            "ft0030": {
                                "value": "b*"
                            }
                        }
                    }
                }
            }
        ],
        "in_order": true,
        "slop": 0
    }
}
}

In Elasticsearch 6.2.4 the query runs successfully in 8643ms, in Elasticsearch 8.4.1 it fails with the below error

{
  "error": {
    "root_cause": [
      {
        "type": "runtime_exception",
        "reason": "runtime_exception: [ft0030:b* ] exceeds maxClauseCount [ Boolean maxClauseCount is set to 80659]"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "bl-tol",
        "node": "r48UuqlkSLiL-t_thpnsdg",
        "reason": {
          "type": "runtime_exception",
          "reason": "runtime_exception: [ft0030:b* ] exceeds maxClauseCount [ Boolean maxClauseCount is set to 80659]"
        }
      }
    ]
  },
  "status": 500
}

If I increase the heap size in Elasticsearch 8.4.1 to 192gb, I can get the above query to run successfully in 69586ms, however several of our other more complicated queries still fail. Any help would be appreciated.

Thanks,

Geoff Willis