Hi ,
Version - ELK 7.1.0
cluster - Single node ELK cluster installed in AWS VM
Have added the date filter in Kibana dashboard , If select more than 2 dates of data getting below error
All shards failed for phase: [query]
org.elasticsearch.common.breaker.CircuitBreakingException: [parent] Data too large, data for [<reused_arrays>] would be [493459960/470.6mb], which is larger than the limit of [493030604/470.1mb], real usage: [493459872/470.6mb], new bytes reserved: [88/88b]
at org.elasticsearch.indices.breaker.HierarchyCircuitBreakerService.checkParentLimit(HierarchyCircuitBreakerService.java:343) ~[elasticsearch-7.1.0.jar:7.1.0]
at org.elasticsearch.common.breaker.ChildMemoryCircuitBreaker.addEstimateBytesAndMaybeBreak(ChildMemoryCircuitBreaker.java:128) ~[elasticsearch-7.1.0.jar:7.1.0]
at org.elasticsearch.common.util.BigArrays.adjustBreaker(BigArrays.java:399) ~[elasticsearch-7.1.0.jar:7.1.0]
When browsed I could find below options to resolve the exception
- Increase the JVM heap size (Where should I increase the heap size )
- Update the indices.breaker.total.limit in elastic search.yml , however I couldn't find the this property in elasticsearch.yml file .
https://www.elastic.co/guide/en/elasticsearch/reference/7.2/circuit-breaker.html
Appreciate your help to guide me to the right direction .
Thanks,
Divya