# Unable to perform search query after 14 days

**URL:** <https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487>\
**Category:** Elasticsearch\
**Created:** [December 5, 2018, 8:46am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487 "2018-12-05T08:46:25Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tafsir_alam/32/72861_2.png) [@Tafsir\_Alam](https://discuss.elastic.co/u/Tafsir_Alam)\
**Post date:** [December 5, 2018, 8:46am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/1 "2018-12-05T08:46:25Z")

</div>

Hi All,

I am able to search logs till `14 days` in graylog but if I search for 30 days or 60 days it prompt `could not execute search` error. Please help me to solve this problem.

Graylog version - 2.4.6  
Elasticsearch - 5.6

 ![28%20PM](https://us1.discourse-cdn.com/elastic/original/3X/4/8/487650902804a90a2853e97e8fabcdd95426e13b.png)

Also sometimes working for 60 days or 30 days but not always. Not able to understand the exact reason why it’s happening.

 ![30%20PM](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa4dc1cb6e020a589d99620c5f403d480f8957ef.png)

This is the search configuration on my graylog.

 ![34%20PM](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3da57edfbd8f4d42b742059f4c42ad7c88220758.png)

Quick reply will be appreciated.  
Thanks

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 5, 2018, 11:17am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/2 "2018-12-05T11:17:52Z")

</div>

May be look at elasticsearch logs? You should see a stacktrace probably.

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tafsir_alam/32/72861_2.png) [@Tafsir\_Alam](https://discuss.elastic.co/u/Tafsir_Alam)\
**Post date:** [December 5, 2018, 11:25am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/3 "2018-12-05T11:25:10Z")

</div>

Thanks for the reply @dadoonet  
I didn't understand **stacktrace**? Can you please elaborate.

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tafsir_alam/32/72861_2.png) [@Tafsir\_Alam](https://discuss.elastic.co/u/Tafsir_Alam)\
**Post date:** [December 5, 2018, 11:28am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/4 "2018-12-05T11:28:17Z")

</div>

What does **surrounding time-range** , **Surrounding search filter fields** and **Disabled analysis fields** options mean?

My current configuration is:

 ![06%20PM](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e90c1f3d65c4d23f4f985d8b95c1f72f99baa60.png)

Is the configuration ok?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 5, 2018, 11:37am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/5 "2018-12-05T11:37:13Z")

</div>

I don't know. You'd better ask on this project forum I believe.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 5, 2018, 11:37am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/6 "2018-12-05T11:37:31Z")

</div>

Just look at elasticsearch logs.

---

<div class="post-metadata">

**Author:** ![Tafsir\_Alam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tafsir_alam/32/72861_2.png) [@Tafsir\_Alam](https://discuss.elastic.co/u/Tafsir_Alam)\
**Post date:** [December 6, 2018, 6:43am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/7 "2018-12-06T06:43:25Z")

</div>

Nothing unusual found in the elasticsearch logs. Also when I perform search query after 14|30|60 days then sometimes I get:

 ![15%20AM](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d30699423947fd5f071543b900a66d2f1788e778.png)

_ **Details message only print:** _ **Unable to perform search query.**

What does this error mean?

Elasticsearch log that I received, but I don't think it's related to my query

```auto
[2018-12-06T07:07:22,161][DEBUG][o.e.a.s.TransportSearchAction] [es-master03.mykaarma.com] [graylog_850][1], node[dkxlWA-BTuui0UvzZ_gf_A], [P], s[STARTED], a[id=tH_XQPPOSHmorm0hKcUQqw]: Failed to execute [SearchRequest{searchType=QUERY_THEN_FETCH, indices=[graylog_850, aws_pi_logs_13, batchjob_logs_66, batchjob_logs_78, infralogs_106], indicesOptions=IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=true, forbid_closed_indices=true], types=[message], routing='null', preference='null', requestCache=null, scroll=null, maxConcurrentShardRequests=20, batchedReduceSize=512, preFilterShardSize=64, source={
  "from" : 0,
  "query" : {
    "bool" : {
      "must" : [
        {
          "query_string" : {
            "query" : "project:BMW_DATA_DUMP AND endpoint:repairorder",
            "fields" : [],
            "use_dis_max" : true,
            "tie_breaker" : 0.0,
            "default_operator" : "or",
            "auto_generate_phrase_queries" : false,
            "max_determinized_states" : 10000,
            "allow_leading_wildcard" : false,
            "enable_position_increments" : true,
            "fuzziness" : "AUTO",
            "fuzzy_prefix_length" : 0,
            "fuzzy_max_expansions" : 50,
            "phrase_slop" : 0,
            "escape" : false,
            "split_on_whitespace" : true,
            "boost" : 1.0
          }
        }
      ],
      "filter" : [
        {
          "bool" : {
            "must" : [
              {
                "range" : {
                  "timestamp" : {
                    "from" : "2018-12-06 07:02:22.145",
                    "to" : "2018-12-06 07:07:22.145",
                    "include_lower" : true,
                    "include_upper" : true,
                    "boost" : 1.0
                  }
                }
              }
            ],
            "disable_coord" : false,
            "adjust_pure_negative" : true,
            "boost" : 1.0
          }
        }
      ],
      "disable_coord" : false,
      "adjust_pure_negative" : true,
      "boost" : 1.0
    }
  },
  "aggregations" : {
    "gl2_histogram" : {
      "date_histogram" : {
        "field" : "timestamp",
        "interval" : "1m",
        "offset" : 0,
        "order" : {
          "_key" : "asc"
        },
        "keyed" : false,
        "min_doc_count" : 0
      },
      "aggregations" : {
        "gl2_stats" : {
          "stats" : {
            "field" : "dealer_number"
          }
        }
      }
    }
  }
}}

```

If not then from which location I can find the exact search query logs.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2019, 6:43am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487/8 "2019-01-03T06:43:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.