# Search\_phase\_execution\_exception in partitioned terms aggregation

**URL:** <https://discuss.elastic.co/t/search-phase-execution-exception-in-partitioned-terms-aggregation/315443>\
**Category:** Elasticsearch\
**Created:** [September 29, 2022, 10:00am UTC](https://discuss.elastic.co/t/search-phase-execution-exception-in-partitioned-terms-aggregation/315443 "2022-09-29T10:00:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sederfo](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@Sederfo](https://discuss.elastic.co/u/Sederfo)\
**Post date:** [September 29, 2022, 10:00am UTC](https://discuss.elastic.co/t/search-phase-execution-exception-in-partitioned-terms-aggregation/315443/1 "2022-09-29T10:00:04Z")

</div>

I have an index which contains millions of documents that I want to aggregate.

This is the query I am using to obtain the aggregated results.

```auto
aggs = {
                "0": {
                    "terms": {
                        "field": "source.ip",
                        "order": {
                            "_count": "desc"
                        },
                        "include": {
                            "partition": i,
                            "num_partitions": nr_partitions
                        },

                        "size": 1000
                    },
                    "aggs": {
                        "1": {
                            "terms": {
                                "field": "destination.ip",
                                "order": {
                                    "_count": "desc"
                                },
                                "size": 1000
                            },
                            "aggs": {
                                "2": {
                                    "terms": {
                                        "field": "destination.port",
                                        
                                        "order": {
                                            "_count": "desc"
                                        },
                                        "size": 1000
                                    },
                                    "aggs": {
                                        "3": {
                                            "terms": {
                                                "field": "cisco.ftd.security.protocol",
                                                "missing": "N/A",
                                                "order": {
                                                    "_count": "desc"
                                                },
                                                "size": 1000
                                            },
                                            "aggs": {
                                                "4": {
                                                    "terms": {
                                                        "field": "cisco.ftd.security.ingress_interface",
                                                        "missing": "N/A",
                                                        "order": {
                                                            "_count": "desc"
                                                        },
                                                        "size": 1000
                                                    },
                                                    "aggs": {
                                                        "5": {
                                                            "terms": {
                                                                "field": "cisco.ftd.security.egress_interface",
                                                                "missing": "N/A",
                                                                "order": {
                                                                    "_count": "desc"
                                                                },
                                                                "size": 1000
                                                            },
                                                            "aggs": {
                                                                "6": {
                                                                    "terms": {
                                                                        "field": "cisco.ftd.security.ingress_zone",
                                                                        "missing": "N/A",
                                                                        "order": {
                                                                            "_count": "desc"
                                                                        },
                                                                        "size": 1000
                                                                    },
                                                                    "aggs": {
                                                                        "7": {
                                                                            "terms": {
                                                                                "field": "cisco.ftd.security.egress_zone",
                                                                                "missing": "N/A",
                                                                                "order": {
                                                                                    "_count": "desc"
                                                                                },
                                                                                "size": 1000
                                                                            },
                                                                            "aggs": {
                                                                                "8": {
                                                                                    "terms": {
                                                                                        "field": "cisco.ftd.security.access_control_rule_name",
                                                                                        "missing": "N/A",
                                                                                        "order": {
                                                                                            "_count": "desc"
                                                                                        },
                                                                                        "size": 1000
                                                                                    },
                                                                                    "aggs": {
                                                                                        "9": {
                                                                                            "terms": {
                                                                                                "field": "url.original",
                                                                                                "missing": "N/A",
                                                                                                "order": {
                                                                                                    "_count": "desc"
                                                                                                },
                                                                                                "size": 1000
                                                                                            },
                                                                                            "aggs": {
                                                                                                "11": {
                                                                                                    "sum": {
                                                                                                        "field": "source.packets"
                                                                                                    }
                                                                                                },
                                                                                                "12": {
                                                                                                    "sum": {
                                                                                                        "field": "destination.packets"
                                                                                                    }
                                                                                                },
                                                                                                "13": {
                                                                                                    "sum": {
                                                                                                        "field": "source.bytes"
                                                                                                    }
                                                                                                },
                                                                                                "14": {
                                                                                                    "sum": {
                                                                                                        "field": "destination.bytes"
                                                                                                    }
                                                                                                },
                                                                                                "15": {
                                                                                                    "avg": {
                                                                                                        "field": "source.packets"
                                                                                                    }
                                                                                                },
                                                                                                "16": {
                                                                                                    "avg": {
                                                                                                        "field": "destination.packets"
                                                                                                    }
                                                                                                },
                                                                                                "17": {
                                                                                                    "avg": {
                                                                                                        "field": "source.bytes"
                                                                                                    }
                                                                                                },
                                                                                                "18": {
                                                                                                    "avg": {
                                                                                                        "field": "destination.bytes"
                                                                                                    }
                                                                                                }
                                                                                            }
                                                                                        }
                                                                                    }
                                                                                }
                                                                            }
                                                                        }
                                                                    }
                                                                }
                                                            }
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }

```

If there are too many documents in the time range that I am querying for, the API throws search\_phase\_execution\_exception with a 503 status code.

How can I obtain the aggregated results for the millions of documents? I tried increasing the number of partitions, but it still gives the same exception.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2022, 10:00am UTC](https://discuss.elastic.co/t/search-phase-execution-exception-in-partitioned-terms-aggregation/315443/2 "2022-10-27T10:00:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.