Increasing index.max_result_window using CentOS CLI

I am using graylog with mongodb and elasticsearch 6.8 on CentOS 7. 
Now I have received an error saying "Elasticsearch limits the search 
result to 10000 messages". How do I increase the index.max_result_window? 
I dont have Kibana installed and I couldnt find any CLI method in CentOS 
to increase this. 

Please help.

Welcome to our community! :smiley:

Try something like this, just replace the things you need to;

curl -XPUT "http://HOST:9200/INDEX/_settings" -d '{ "index" : { "max_result_window" : NUMBER } }'

Thanks Warkolm.

But, once I applied the command, the following error appears.

{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}

Ahh yes, you need to add -H "Content-Type: application/json" as well :slight_smile:

Thanks again Warkolm.

I entered the following command.
curl -XPUT "http://localhost:9200/INDEX/_settings" -d '{ "index" : { "max_result_window" : 800000 } }' -H "Content-Type: application/json"

However, another 404 error appears as follows.

{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","":"INDEX","index_uuid":"na","index":"INDEX"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","":"INDEX","index_uuid":"na","index":"INDEX"},"status":404}

Did you change INDEX for the index name you want to alter the setting for?

No I didn't create an index with the name "INDEX" for this max_result_window. If it is needed, may I know how to do that using CLI?

You need to replace the INDEX in the command with the actual index name you want this setting applied to.

After configuring the below, it worked.

curl -XPUT "http://localhost:9200/_all/_settings" -d '{ "index" : { "max_result_window" : 800000 } }' -H "Content-Type: application/json" .

Thanks for the support given.

Hi Warkolm,

Sorry for reopening the case again :slight_smile: .

I need to reenter the following command daily otherwise it shows only 66 pages. How do I make this index value persistent?

curl -XPUT "http://localhost:9200/_all/_settings" -d '{ "index" : { "max_result_window" : 800000 } }' -H "Content-Type: application/json"

Look into index templates.

Ok I will Warkolm.

I have another concern. I have created a user called “NOC” using Graylog GUI. When logged into Graylog from NOC user, I face the same issue of viewing pages after 66. How can I increase the index of this user using CentOS CLI? Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.