Term aggregation size well with in search.max_buckets, still getting too-many-bucket errors

[nicholasb (Nicholas Basker)]

The ES setup is with single-node and single-shard. There are around 15000 records being added on a given 8-hour window on a specific index. The search.max_buckets is set to 10000.

For the following query, if the size is 6000 the query returns 6001 records for given day. But when the size is increased to 7000, too-many-buckets error is returned. Why when the search.max_buckets is set to 10000, when asked for size of 7000 (which can result in a maximum of 7000 buckets) which is well within search.max_buckets this error is reported.

Tried property repo_key is "keyword" and is not analysed.
The query below is filtered for the 8-hour window and there are no duplicate records.

Any explanation on why this error is given would help a lot.

  "aggs": {
    "data": {
      "aggs": {
        "output": {
          "aggs": {
            "used_space": {
              "avg": {
                "field": "used_space"
              }
            }
          },
          "terms": {
            "size": 6000,
            "order": {
              "used_space": "desc"
            },
            "field": "repo_key"
          }
        }
      },
      "date_histogram": {
        "field": "timestamp",
        "calendar_interval": "1d",
        "min_doc_count": 0,
        "time_zone": "+05:30",
        "format": "date_hour_minute_second"
      }
    }
  },

Thanks.