"Result window is too large" http response depends on the presence of the sort field

Elastic Stack Elasticsearch
1

Hi,

I'm facing a strange behaviour on Elasticsearch 7.7 when I perform a search on several indexes and the result window is too large.
If the query is:

GET /_search
{
  "size": 500,
  "from": 10000,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "stop": {
              "gte": "2021-01-01T11:40:00Z"
            }
          }
        },
        {
          "range": {
            "start": {
              "lte": "2021-04-01T11:40:00Z"
            }
          }
        }
      ]
    }
  }
}

then the response code is 400, with

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "Result window is too large, from + size must be less than or equal to: [10000] but was [10500]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max_result_window] index level setting."
      },
[...]

But if the query contains a sort field:

GET /_search
{
  "size": 500,
  "from": 10000,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "stop": {
              "gte": "2021-01-01T11:40:00Z"
            }
          }
        },
        {
          "range": {
            "start": {
              "lte": "2021-04-01T11:40:00Z"
            }
          }
        }
      ]
    }
  },
  "sort": [
    {
      "start": {
        "order": "desc",
        "missing": "_first"
      }
    }
  ]
}

then the response code is 200 with

{
  "took" : 112,
  "timed_out" : false,
  "_shards" : {
    "total" : 28,
    "successful" : 19,
    "skipped" : 19,
    "failed" : 9,
    "failures" : [
      {
        "shard" : 0,
        "index" : "my-index-1",
        "node" : "gIeCOD9jQxyVUQUahxmIXg",
        "reason" : {
          "type" : "illegal_argument_exception",
          "reason" : "Result window is too large, from + size must be less than or equal to: [10000] but was [10500]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max_result_window] index level setting."
        }
      },
      {
[...]

Is it normal? Should the response codes be the same?

1 Like
2

It looks like a bug to me. Could you try to reproduce it on 7.14.1 and if you can open an issue in GitHub?

3

I just tested in 7.14.1 and it gives a "status" : 400 so it must have been fixed at some point.

2 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.