Keep getting error in data table for security graph

Hi- I keep getting error in kibana when doing data table for my security graph..

Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"too_many_buckets_exception","reason":"Trying to create too many buckets. Must be less than or equal to: [10000] but was [10001]. This limit can be set by changing the [search.max_buckets] cluster level setting.","max_buckets":10000},{"type":"too_many_buckets_exception","reason":"Trying to create too many buckets. Must be less than or equal to: [10000] but was [10048]. This limit can be set by changing the [search.max_buckets] cluster level setting.","max_buckets":10000}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"securitylogs","node":"jVnX9ZTkRfqTbw4Gz2odGA","reason":{"type":"too_many_buckets_exception","reason":"Trying to create too many buckets. Must be less than or equal to: [10000] but was [10001]. This limit can be set by changing the [search.max_buckets] cluster level setting.","max_buckets":10000}},{"shard":4,"index":"securitylogs","node":"jVnX9ZTkRfqTbw4Gz2odGA","reason":{"type":"too_many_buckets_exception","reason":"Trying to create too many buckets. Must be less than or equal to: [10000] but was [10048]. This limit can be set by changing the [search.max_buckets] cluster level setting.","max_buckets":10000}}]},"status":503}

Am i able to edit the max buckets on kibana? or do I have to edit them on elasticsearch? Or where is it?

Can you show the settings for the data table?

Hi Mark,

These settings?

1 Like

Yep, thanks. And what sort of timeframe are you running this over?

Daily Timeframe, I believe thats whats causing the error..
But the thing is, we need to have the daily timeframe set up!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.