# User Limits on queries **URL:** \ **Category:** Elasticsearch\ **Created:** [April 6, 2016, 3:05pm UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552 "2016-04-06T15:05:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![lawndart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lawndart/32/8668_2.png) [@lawndart](https://discuss.elastic.co/u/lawndart)\ **Post date:** [April 6, 2016, 3:05pm UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/1 "2016-04-06T15:05:48Z")
I have an 8 data node ES cluster (a development one with about 4TB of data in 2 billion documents) with Kibana attached and I'm looking for a way to limit the size or scope of the queries that Kibana can request. I've managed to lock all the ES nodes twice now (on mostly purpose) by doing very heavy aggregation queries over a large number of shards and time spans. The search threads are all consumed and the ES process stops responding to service requests and has to be killed. Since I'm building this for production and would like to be able to turn less trained analysts loose on Kibana, what can I do to make sure they can't kill my cluster? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 6, 2016, 11:52pm UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/2 "2016-04-06T23:52:10Z")
What version are you on? There are some soft limits in the latest versions, with more coming in v5, to help with this. But otherwise it is limited. ---
**Author:** ![lawndart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lawndart/32/8668_2.png) [@lawndart](https://discuss.elastic.co/u/lawndart)\ **Post date:** [April 7, 2016, 12:11am UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/3 "2016-04-07T00:11:30Z")
We just moved to ES 2.3 and Kibana 4.5 in the last week. What soft limits do you mean? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 7, 2016, 12:42am UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/4 "2016-04-07T00:42:46Z")
Things like [https://www.elastic.co/guide/en/elasticsearch/reference/2.3/breaking\_21\_search\_changes.html#\_from\_size\_limits](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/breaking_21_search_changes.html#_from_size_limits) ---
**Author:** ![lawndart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lawndart/32/8668_2.png) [@lawndart](https://discuss.elastic.co/u/lawndart)\ **Post date:** [April 7, 2016, 12:50am UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/5 "2016-04-07T00:50:02Z")
What is the "from + size" in this context? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 7, 2016, 5:45am UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/6 "2016-04-07T05:45:07Z")
[https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-from-size.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-from-size.html) It's just an example of the things we are putting in. ---
**Author:** ![lawndart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lawndart/32/8668_2.png) [@lawndart](https://discuss.elastic.co/u/lawndart)\ **Post date:** [April 7, 2016, 3:33pm UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/7 "2016-04-07T15:33:04Z")
Great, thanks for the information, I will check those out and look forward to more. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:01pm UTC](https://discuss.elastic.co/t/user-limits-on-queries/46552/8 "2017-07-05T23:01:26Z")