# Risk of updating search.max\_buckets **URL:** \ **Category:** Kibana\ **Created:** [October 7, 2019, 6:22am UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478 "2019-10-07T06:22:23Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![peropero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peropero/32/53554_2.png) [@peropero](https://discuss.elastic.co/u/peropero)\ **Post date:** [October 7, 2019, 6:22am UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/1 "2019-10-07T06:22:23Z")
I am using kibana 7.2.0. What is the effect or risk of doing the following: `` PUT _cluster / settings {"persistent": {"search.max_buckets": 50000}}` ` When I looked it up, I found an article with the following expression: > Note that search.max\_buckets is a safety soft limit designed to prevent unauthorized aggregation from damaging nodes. Therefore, be careful not to set the limit too high. If the limit trips frequently, it may be necessary to review or create the aggregates small. Want to know more specifically about safety soft-limit, Is there a risk of losing logs? I'm also concerned about CPU performance. And Is it possible to create a graph for 20,000,000 logs? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [October 11, 2019, 1:53pm UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/2 "2019-10-11T13:53:12Z")
There is indeed a risk of crashing or overloading the ES server, in which case it could mean losing data that's being ingested at that time. You can create a graph 20.000.000 logs, even way more, but only if it's aggregated. I would highly recommend against creating 20.000.000 buckets. ---
**Author:** ![peropero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peropero/32/53554_2.png) [@peropero](https://discuss.elastic.co/u/peropero)\ **Post date:** [October 17, 2019, 4:24am UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/3 "2019-10-17T04:24:04Z")
Thank you for reply. You are hero. one more, What can I do to increase the value of search.max\_buckets? I want an Indicator value. Is there a document? For example, if the log size is about this, By increasing the CPU or DISK size, the value of search.max\_buckets can be set to XXXX etc... ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [October 18, 2019, 2:32pm UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/4 "2019-10-18T14:32:45Z")
I would say increasing the JVM size is the way to go to handle more. Also CPU for making the requests take less time. This is off the top of my head. For more detailed tunes, the Elasticsearch team will have more info than me. Just post a question in their part of the forum and they'll get back to you. ---
**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Post date:** [October 18, 2019, 2:42pm UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/5 "2019-10-18T14:42:13Z")
By experince i would never suggest change search.max\_buckets, i suggest to keep the default setup to 10K buckets and use [partitions](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_filtering_values_with_partitions) ---
**Author:** ![peropero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peropero/32/53554_2.png) [@peropero](https://discuss.elastic.co/u/peropero)\ **Post date:** [October 21, 2019, 6:01am UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/6 "2019-10-21T06:01:45Z")
To ylasri Thank you for reply. Why do you recommend it? What exactly happened? ---
**Author:** ![peropero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peropero/32/53554_2.png) [@peropero](https://discuss.elastic.co/u/peropero)\ **Post date:** [October 21, 2019, 6:03am UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/7 "2019-10-21T06:03:53Z")
To Matius Thak you for reply!! Where is the "forum" ? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [October 22, 2019, 3:43pm UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/8 "2019-10-22T15:43:24Z")
This one: [https://discuss.elastic.co/c/elasticsearch](https://discuss.elastic.co/c/elasticsearch) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 19, 2019, 3:43pm UTC](https://discuss.elastic.co/t/risk-of-updating-search-max-buckets/202478/9 "2019-11-19T15:43:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.