TooManyBuckets Exception

I am using ES 7.3 with Kibana.
I encountered this error in a few visualisations and I cannot figure out what is wrong.
For example - I am trying to visual a time line of Bytes read/write per host.

But I am getting this error :$TooManyBucketsException: 
Trying to create too many buckets. Must be less than or equal to: [12000] but was [12001]. 
This limit can be set by changing the [search.max_buckets] cluster level setting.

I tried increasing the max buckets to 12000, but it still fails.

What I know -

  • Multiple indices are searched as my index pattern covers a few indices and not just one.
  • If I reduce the time filter the visualisation works. e.g. from 'Today' to 'Last 1 hour'

So, the questions are:
What is wrong?
What should I check?
How should I fix this?

I read a few previous discussions, but couldn't find any ones that could help me.


What are you settings for those buckets? What is the cardinality if the ComputerName field?

Hi @Christian_Dahlqvist
Thanks for your reply.
Cardinality is around 500 unique values.
Settings -

Tried playing with the size parameter. How is it affecting the visualisation?

Thank you

What about the date histogram? Do you have fixed size buckets?

Hi @Christian_Dahlqvist
Yes, time buckets are set to timestamp per 10 minutes. Although I tried to set it to 5 minutes.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.