Grafana Shard Limit 1000

[ariceELK (Aidan Rice)]

Hi,

Im using ES v5.2.0 and Grafana v4.1

Im getting an error in Grafana when the number of shards in ES is over 1000. Grafana won't display any data.

Is there a setting to increase this limit ?

Thanks
Aidan

[ywelsch (Yannick Welsch)]

From the docs:

By default elasticsearch rejects search requests that would query more than 1000 shards. The reason is that such large numbers of shards make the job of the coordinating node very CPU and memory intensive. It is usually a better idea to organize data in such a way that there are fewer larger shards. In case you would like to bypass this limit, which is discouraged, you can update the action.search.shard_count.limit cluster setting to a greater value.

[ariceELK (Aidan Rice)]

thank you...

[ariceELK (Aidan Rice)]

Hi,

I have another related issue.
We are using fields.ipaddr as a text sting and both grafana and elasticsearch are complaining, advising to add it to fielddata. fielddata=true on [fields.ipaddr]

PUT filebeat-*/_mapping/my_type
{
"properties": {
"my_field": { "fields.ipaddr"
"type": "text",
"fielddata": true
}
}
}

is failing to parse the content to map ?

Brgds
Aidan