Set more than 10000 number of values in data tables

Elastic Stack Kibana
,
1

Hi, I'm trying to fetch more than 10000 number of values in my kibana data table visualization.

image
image472Ă—804 32.8 KB

I get the error above, I edited index.max_result_window in all my elasticSearch indexes. But I get the same error

I can use the same query changing the size value in json format, it works, but in Kibana not.

{
    "aggs": {
      "0": {
        "terms": {
          "field": "XXXXXXXX",
          "order": {
            "_count": "desc"
          },
          "size": 100000
        }
      }
    },
    "size": 0,
    "fields": [
      {
        "field": "Date",
        "format": "date_time"
      },
      {
        "field": "insertion_time",
        "format": "date_time"
      }
    ],
    "script_fields": {},
    "stored_fields": [
      "*"
    ],
    "runtime_mappings": {},
    "_source": {
      "excludes": []
    },
    "query": {
      "bool": {
        "must": [],
        "filter": [
          {
            "bool": {
              "must_not": {
                "bool": {
                  "should": [
                    {
                      "match": {
                        "Progressive": "1"
                      }
                    }
                  ],
                  "minimum_should_match": 1
                }
              }
            }
          },
          {
            "range": {
              "Date": {
                "format": "strict_date_optional_time",
                "gte": "2025-02-25T09:28:56.413Z",
                "lte": "2025-03-12T09:28:56.413Z"
              }
            }
          }
        ],
        "should": [],
        "must_not": []
      }
    }
  }

What can I do to get it work?
Kibana version: 8.9.0
Elastic version: 8.9.0

2

in short; You can’t.

In Kibana Lens/Data Table, the “Top values → Number of values” has a hard UI cap of 10,000 per terms agg. Changing index.max_result_window (hits pagination) doesn’t affect this, and ES might accept size: 100000 via API, but Lens won’t.

Workarounds

  • Use the Elasticsearch API with a composite aggregation (paginated via after_key) to fetch >10k buckets.

  • Or materialize results with a Transform/rollup and visualize that.

  • If you truly need all distinct values in Kibana, rethink the viz—10k+ buckets is heavy and slow.

instead, use a composite aggregation in Python and page through all buckets.

1 Like
3

Hi @Ruben_Mendez

just to confirm: are you looking for more than 10000 possible values or more than 10000 rows?

Because the Lens control is actually asking “how many distinct values” it should look for in your aggregation, nothing about the exact number of result rows (it can be also in the order of millions possibly)

4

Hi @Ruben_Mendez

We see below enhancement open similar to the one you have raised in this post :

Thanks!!