Need Clarification Regarding Size Parameter in ES Query

[sayamiasis (aashish manandhar)]

I wanted to know if there is a difference in executing these two queries when the result response is consisting of only 3 documents.

query1:

{
	"size":10,
	"query": {
		"bool":{
			"must":[
				{
					"term":{
						"type":"sometype"
					}
				}
			]
		}
	}
}

query 2:

{
	"size":2147483647,
	"query": {
		"bool":{
			"must":[
				{
					"term":{
						"type":"sometype"
					}
				}
			]
		}
	}
}

the query with size:10 gave immediate response (3 documents that existed), whereas the 2nd query took a whole long time and caused my ES to be unresponsive and ultimately went down.

I'd like to know the reason behind this.

Details: I was working in a 10 node cluster for a 2 TB index (size seems pretty huge for a 10 node cluster). Each node with 30 GB ES heap size.

[Christian_Dahlqvist]

Which version of Elasticsearch are you using? In recent versions I would expect the second query to fail before running.

[sayamiasis (aashish manandhar)]

Sorry forgot to mention the verison.
These queries were hit on ES Version: 7.11

Also, as i mentioned the 2nd query doesn't fail instanlty. Instead, it keeps running and brings the whole ES down. This problem was faced just for this case (2 tb index size with 10 nodes) . Haven't faced such issue in other configurations. However, my concern was, if its returning only 3 documents ultimately, it shouldn't have failed, regardless of the size parameter.

[Christian_Dahlqvist]

Do you have any custom configuration? The size parameter should as far as I know by default be limited to 10000.