Kibana Search Error - Service Unavailable

[mpavelka]

Hello,
cluster setup: 3 master data nodes, 1 coordinator. versions of ES and Kibana: 7.10.1, status green.
I am trying to create a table visualization and I am getting for the particular index pattern Search Error - Service Unavailable:

search_phase_execution_exception


Error: Service Unavailable
    at Fetch._callee3$ (http://xxxxx:5603/kibana/36063/bundles/core/core.entry.js:6:59535)
    at l (http://xxxxx/kibana/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740520)
    at Generator._invoke (http://xxxxx:5603/kibana/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740273)
    at Generator.forEach.e.<computed> [as next] (http://xxxxx:5603/kibana/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740877)
    at fetch_asyncGeneratorStep (http://xxxxx:5603/kibana/36063/bundles/core/core.entry.js:6:52652)
    at _next (http://xxxxxx:5603/kibana/36063/bundles/core/core.entry.js:6:52968)

There are dozen of thousands of documents in the index which must be queried during the visualization but I have never encountered problems with the table visualization.

When I apply a filter and narrow down the count of documents to about 2000, then the error disappears.

Is there a setting for Kibana/Elastic which could increase the number of documents that can the visualization handle without error?

[Aaron_Caldwell]

Hello,

I'm not sure offhand why results wouldn't just be capped at 10,000. Having said, that, you could try increasing the index.max_result_window in elasticsearch beyond the default 10,000: Index modules | Elasticsearch Reference [7.12] | Elastic.

You might want to be conservative with these adjustments to prevent needlessly large results in other visualizations.

Regards,
Aaron

[mpavelka]

Hello Aaron,
thanks for reply. I found out as well that the number of documents it can handle is also given by number of columns in the table. So the current workaround is to have more tables with less columns and this seems to work. So I will for now avoid modifying the config, as this is the first occurrence of such problems - other table visualizations on different indexes work fine.