I read the terms is limited to around 65k on the default config. However, I am trying to make a query with around 2k values in the terms and it is failing. I notice if I use 665 works fine but if I add an extra value it fails and the error displayed does not help:
{"statusCode":400,"error":"Bad Request","message":"[request query.method]: Method must be one of, case insensitive ['HEAD', 'GET', 'POST', 'PUT', 'DELETE']. Received '\"as\"'."}
Field "as" is defined as long on filebeat index.
"as" : {
"properties" : {
"number" : {
"type" : "long"
},
This is the query (suppressing most of the values just for readability reasons):
POST filebeat-*/_search
{
"query": {
"bool": {
"must": [
{
"terms": {
"as": [135242, 135243, 135244, 135245]
}
}
]
}
}
}
I also tried similar query with a keyword field and faced the same issue. I am using Elastic Cloud and the version is 7.17.6.
Any ideas why I cannot use a higher number of elements in the terms?
Regards,
Cesar