# Restirct users with search filter **URL:** \ **Category:** Elasticsearch\ **Created:** [October 28, 2019, 10:31pm UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558 "2019-10-28T22:31:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![shappy123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shappy123/32/51133_2.png) [@shappy123](https://discuss.elastic.co/u/shappy123)\ **Post date:** [October 28, 2019, 10:31pm UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558/1 "2019-10-28T22:31:09Z")
Hi, Can anyone please assist me on this : I need users not to search huge queries or if they search queries on kibana discover , they must add a filter. The reason behind this is because users queries huge amount of data for example ( last 30 days without providing any filter in search query ) which results in our cluster to be crashed. Kindly let me know if this can work or any other alternative. Cheers Shappy ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 29, 2019, 6:46am UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558/2 "2019-10-29T06:46:30Z")
If using the Discover app, which by default returns 500 documents, without a filter against 30 days of data can cause the cluster to crash I would suggest your cluster might be overloaded and need more heap or less data/shards per node. What is the full output of the [cluster stats API](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/cluster-stats.html)? Which version are you on? ---
**Author:** ![shappy123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shappy123/32/51133_2.png) [@shappy123](https://discuss.elastic.co/u/shappy123)\ **Post date:** [October 30, 2019, 3:58am UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558/3 "2019-10-30T03:58:22Z")
Hi Christian, here is the output { "\_nodes" : { "total" : 3, "successful" : 3, "failed" : 0 }, "cluster\_name" : "abcdefghijklmnop", "cluster\_uuid" : "xxxxxx-xxxxxxxxx-xxxxxxxxxx", "timestamp" : 1572407585476, "status" : "green", "indices" : { "count" : 140, "shards" : { "total" : 485, "primaries" : 271, "replication" : 0.7896678966789668, "index" : { "shards" : { "min" : 1, "max" : 5, "avg" : 3.4642857142857144 }, "primaries" : { "min" : 1, "max" : 5, "avg" : 1.9357142857142857 }, "replication" : { "min" : 0.0, "max" : 1.0, "avg" : 0.8928571428571429 } } }, "docs" : { "count" : 648905413, "deleted" : 16237427 }, "store" : { "size\_in\_bytes" : 238025811722 }, "fielddata" : { "memory\_size\_in\_bytes" : 6472, "evictions" : 0 }, "query\_cache" : { "memory\_size\_in\_bytes" : 788566347, "total\_count" : 48481301, "hit\_count" : 12587141, "miss\_count" : 35894160, "cache\_size" : 12859, "cache\_count" : 194916, "evictions" : 182057 }, "completion" : { "size\_in\_bytes" : 0 }, "segments" : { "count" : 5883, "memory\_in\_bytes" : 683794717, "terms\_memory\_in\_bytes" : 438652238, "stored\_fields\_memory\_in\_bytes" : 193350592, "term\_vectors\_memory\_in\_bytes" : 0, "norms\_memory\_in\_bytes" : 17025344, "points\_memory\_in\_bytes" : 22842385, "doc\_values\_memory\_in\_bytes" : 11924158, "index\_writer\_memory\_in\_bytes" : 85502072, "version\_map\_memory\_in\_bytes" : 26523109, "fixed\_bit\_set\_memory\_in\_bytes" : 1424832, "max\_unsafe\_auto\_id\_timestamp" : 1572399066225, "file\_sizes" : { } } }, "nodes" : { "count" : { "total" : 3, "coordinating\_only" : 0, "data" : 2, "ingest" : 2, "master" : 3, "voting\_only" : 1 }, "versions" : [ "7.3.1" ], "os" : { "available\_processors" : 5, "allocated\_processors" : 8, "names" : [ { "name" : "Linux", "count" : 3 } ], "pretty\_names" : [ { "pretty\_name" : "CentOS Linux 7 (Core)", "count" : 3 } ], "mem" : { "total\_in\_bytes" : 547729580032, "free\_in\_bytes" : 12033003520, "used\_in\_bytes" : 535696576512, "free\_percent" : 2, "used\_percent" : 98 } }, "process" : { "cpu" : { "percent" : 2 }, "open\_file\_descriptors" : { "min" : 278, "max" : 3182, "avg" : 2189 } }, "jvm" : { "max\_uptime\_in\_millis" : 1132870121, "versions" : [ { "version" : "11.0.4", "vm\_name" : "OpenJDK 64-Bit Server VM", "vm\_version" : "11.0.4+11-LTS", "vm\_vendor" : "Oracle Corporation", "bundled\_jdk" : true, "using\_bundled\_jdk" : false, "count" : 3 } ], "mem" : { "heap\_used\_in\_bytes" : 7102047840, "heap\_max\_in\_bytes" : 16680222720 }, "threads" : 252 }, "fs" : { "total\_in\_bytes" : 1035087118336, "free\_in\_bytes" : 791000879104, "available\_in\_bytes" : 791000879104 }, "plugins" : [ { "name" : "repository-s3", "version" : "7.3.1", "elasticsearch\_version" : "7.3.1", "java\_version" : "1.8", "description" : "The S3 repository plugin adds S3 repositories", "classname" : "org.elasticsearch.repositories.s3.S3RepositoryPlugin", "extended\_plugins" : , "has\_native\_controller" : false } ], "network\_types" : { "transport\_types" : { "security4" : 3 }, "http\_types" : { "security4" : 3 } }, "discovery\_types" : { "zen" : 3 }, "packaging\_types" : [ { "flavor" : "default", "type" : "tar", "count" : 3 } ] } } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 30, 2019, 6:07am UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558/4 "2019-10-30T06:07:00Z")
Those stats don't look that bad at all, but you do seem to have more small shards than recommended. Although they have not yet reached alarming levels you may want to look to reduce this, e.g. by switching to weekly indices instead of daily. If you have monitoring enabled it would be interesting to see a picture of heap usage over time as this could be driven by requests and queries. ---
**Author:** ![shappy123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shappy123/32/51133_2.png) [@shappy123](https://discuss.elastic.co/u/shappy123)\ **Post date:** [October 30, 2019, 8:56pm UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558/5 "2019-10-30T20:56:31Z")
Hi christain, Thanks for the reply, so means there is no such option to restrict users for search large data, as you mentioned earlier by default it returns 500 docs, can that be catered like making that default search reduce to 50%, would that help somehow. Cheers ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 31, 2019, 6:10am UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558/6 "2019-10-31T06:10:17Z")
I am not aware of any way to restrict it in a good way. Can you share the logs from around the time you see a crash? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2019, 6:10am UTC](https://discuss.elastic.co/t/restirct-users-with-search-filter/205558/7 "2019-11-28T06:10:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.