In ElasticSearch version 7.14.2, the following query causes the estimated_size of the request circuit breaker to keep increasing and will not decrease even after 1-2 days

Elastic Stack Elasticsearch
1

This index has 2 million documents, each with approximately 300 fields. The query syntax is as follows:

GET /option_indicator/_search

{

  "profile": true,

  "_source": true,

  "track_total_hits": true,

  "size": 0,

  "aggs": {

    "group_by_chain": {

      "multi_terms": {

        "terms": [

          { "field": "sc_name" },

          { "field": "en_name" },

          { "field": "oi_day_chg" },

          { "field": "option_id" },

          { "field": "chg_ratio" },

          { "field": "ask_volume" },

          { "field": "bid_volume" },

          { "field": "oi_week_chg" }

        ],

        "size":20000

      },

      "aggs": {

        "top_option_list": {

          "top_hits": {

            "size": 1, 

            "sort": [{ "volume": { "order": "desc" } }],

             "_source": {

              "includes": ["option_id", "en_name","volume"] 

            }

          }

        }

      }

    }

  }

}
2

I tried other query syntaxes and didn't have this problem, such as aggregation with composite + source.

3

The version of Elasticsearch you are running was released over 4 years ago and has been EOL and unsupported a long, long time. I would recommend upgrading to a recent and supported version, ideally the latest 9.x, and check whether the reported issue is still present there.

4

Could you please help confirm if this version contains this potential issue?

Many locations within our company likely use this version of the server. If the problem is confirmed, then we should inform everyone.

5

I do unfortunately not have time to look through 4 years worth of potential issues and fixes or set up environments to try and recreate it. I would recommend you test it yourself with a new and supported version (ideally the latest) as I assume you know how to recreate the issue.

6

You should anyways inform them they are using an unsupported version from 4+ years ago? And also inform whichever team looks after these installations!?

7

@RainTown @Christian_Dahlqvist
This issue should have been fixed by MR.

8

That fix was included in Elasticsearch 7.15 so you will need to upgrade to get that. I would recommend upgrading to an as recent version as possible.