[metrics:max_buckets] vs [search.max_buckets]

[peropero (x)]

● Question
Is the upper limit for [metrics: max_buckets] 1000?
What is the difference between [metrics: max_buckets] and [search.max_buckets]?

● Background
I am using kibana 7.2.0.

The following error was displayed.

Error in visualization
[tsvb]> Max buckets exceeded: 2040 is greater than 2000, try a larger time interval in the panel options.

After that, if you change the setting from Advanced Setting as follows,

before-> metrics: max_buckets = 2000 (default)
after-> metrics: max_buckets = 15000

The following error was displayed.
The request for this panel failed

Try being to create too many buckets. Must be less than or equal to: [10000] but was [10001]. This limit can be set by changing the [search.max_buckets] cluster level setting.

#elasticksearch

[markov00 (Marco Vettorello)]

Hi @peropero

search.max_buckets is a cluster level setting that is designed to prevent wrongly aggregations to hurt your cluster. You can change that setting using the Cluster settings API

metrics: max_buckets is a Kibana advanced settings used by TSVB to prevent rendering too many data points (this can hurt the browser running the visualization/dashboard).

You have to follow this rule: metrics:max_buckets <= search:max_buckets

In your case the error message says: that the aggregation require 2040 buckets (that is below the 10.000 default limit if search:max_buckets but above the default 2000 buckets in metrics:max_buckets.
You can configure the metrics:max_buckets to something like 3000 or anything below the current search:max_buckets value.