Increasing index.max_result_window using CentOS CLI

Elastic Stack Elasticsearch
1 
I am using graylog with mongodb and elasticsearch 6.8 on CentOS 7. 
Now I have received an error saying "Elasticsearch limits the search 
result to 10000 messages". How do I increase the index.max_result_window? 
I dont have Kibana installed and I couldnt find any CLI method in CentOS 
to increase this. 

Please help.
2

Welcome to our community! :smiley:

Try something like this, just replace the things you need to;

curl -XPUT "http://HOST:9200/INDEX/_settings" -d '{ "index" : { "max_result_window" : NUMBER } }'
3

Thanks Warkolm.

But, once I applied the command, the following error appears.

{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}

4

Ahh yes, you need to add -H "Content-Type: application/json" as well :slight_smile:

5

Thanks again Warkolm.

I entered the following command.
curl -XPUT "http://localhost:9200/INDEX/_settings" -d '{ "index" : { "max_result_window" : 800000 } }' -H "Content-Type: application/json"

However, another 404 error appears as follows.

{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"INDEX","index_uuid":"na","index":"INDEX"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"INDEX","index_uuid":"na","index":"INDEX"},"status":404}

6

Did you change INDEX for the index name you want to alter the setting for?

7

No I didn't create an index with the name "INDEX" for this max_result_window. If it is needed, may I know how to do that using CLI?

8

You need to replace the INDEX in the command with the actual index name you want this setting applied to.

9

After configuring the below, it worked.

curl -XPUT "http://localhost:9200/_all/_settings" -d '{ "index" : { "max_result_window" : 800000 } }' -H "Content-Type: application/json" .

Thanks for the support given.

10

Hi Warkolm,

Sorry for reopening the case again :slight_smile: .

I need to reenter the following command daily otherwise it shows only 66 pages. How do I make this index value persistent?

curl -XPUT "http://localhost:9200/_all/_settings" -d '{ "index" : { "max_result_window" : 800000 } }' -H "Content-Type: application/json"

11

Look into index templates.

12

Ok I will Warkolm.

I have another concern. I have created a user called “NOC” using Graylog GUI. When logged into Graylog from NOC user, I face the same issue of viewing pages after 66. How can I increase the index of this user using CentOS CLI? Thanks

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.