Issue with RecyclerBytesStreamOutput

[aurelien.guillaume (aurelien)]

Hi,

I'm new in the usage of Elasticsearch (integrated into a security onion appliance)

I'm working to get a huge query (2.5M logs), and I'm stuck with this error message

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "RecyclerBytesStreamOutput cannot hold more than 2GB of data"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "RecyclerBytesStreamOutput cannot hold more than 2GB of data"
  },
  "status": 400
}

can you help me going over the 2GB limit ?

Thanks

[warkolm (Mark Walkom)]

Welcome to our community!

@aurelien.guillaume

I'm working to get a huge query (2.5M logs), and I'm stuck with this error message

What is the query?
What version of Elasticsearch?

[aurelien.guillaume (aurelien)]

Hi Warkolm,
Thanks

the query is the following (hostname as been removed from the query), I did not write myself this query, I've reformatted it from a Kibana request as I don't know yet how to properly write one

{"query": {"bool": {"must": [],"filter": [{"multi_match": {"type": "phrase","query": "some-hostname","lenient": true}},{"match_phrase":{"event.dataset.keyword":"syslog"}},{"range": {"@timestamp": {"format": "strict_date_optional_time","gte": "2023-02-11T09:00:00.000Z","lte": "2023-02-13T02:00:00.000Z"}}}],"should": [],"must_not": []}}}

and the version number is 8.6.1

regards,

[aurelien.guillaume (aurelien)]

Hi,
is anyone having a solution for that ?

Thanks,