# Why my buckets's doc\_count is limit to 3000? **URL:** \ **Category:** Elasticsearch\ **Created:** [August 12, 2014, 9:24am UTC](https://discuss.elastic.co/t/why-my-bucketss-doc-count-is-limit-to-3000/19225 "2014-08-12T09:24:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![11162](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/11162/32/1343_2.png) [@11162](https://discuss.elastic.co/u/11162)\ **Post date:** [August 12, 2014, 9:24am UTC](https://discuss.elastic.co/t/why-my-bucketss-doc-count-is-limit-to-3000/19225/1 "2014-08-12T09:24:01Z")
this is my DSL { > "query":{ > "match\_all":{} > }, > > ``` > "aggs": { > "range": { > "date_range": { > "field": "@timestamp", "format": > > ``` > > "yyy.MM.dd.HH.mm.ss", > "ranges": [{"from": "2014.08.12.09.18.45", "to": > "2014.08.12.09.20.50"}] > }, > "aggs": { > "over\_time": { > "date\_histogram": { > "field": "@timestamp", > "interval": "1s", > "format": "yyy.MM.dd.HH.mm.ss" > }, > "aggs": { > "total\_sent": { > "sum": {"field": "bytes\_sent"} > } > } > } > } > } > } > } thus is my result { - "took":6, - "timed\_out":false, - "\_shards":{ - "total":96, - "successful":96, - "failed":0 }, - "hits":{ - "total":258002, - "max\_score":0.0, - "hits":[ ] }, - "aggregations":{ - "range":{ - "buckets":[ - { - "key":"2014.08.12.09.18.45-2014.08.12.09.20.50", - "from":1.407835125E12, - "from\_as\_string":"2014.08.12.09.18.45", - "to":1.40783525E12, - "to\_as\_string":"2014.08.12.09.20.50", - "doc\_count":12000, - "over\_time":{ - "buckets":[ - { - "key\_as\_string":"2014.08.12.09.18.45", - "key":1407835125000, - "doc\_count":3000, - "total\_sent":{ - "value":6.6126308E7 } }, - { - "key\_as\_string":"2014.08.12.09.18.47", - "key":1407835127000, - "doc\_count":3000, - "total\_sent":{ - "value":9.286586E7 } }, - { - "key\_as\_string":"2014.08.12.09.18.49", - "key":1407835129000, - "doc\_count":3000, - "total\_sent":{ - "value":1.21316184E8 } }, - { - "key\_as\_string":"2014.08.12.09.18.51", - "key":1407835131000, - "doc\_count":3000, - "total\_sent":{ - "value":8.3529544E7 } } ] } } ] } } } my soft flow is: Nginx ==pipe==\> syslogng ==udp==\> logstash ==es\_river==\> elasticsearch How can I break the 3000doc/sec ? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\ **Post date:** [August 12, 2014, 1:27pm UTC](https://discuss.elastic.co/t/why-my-bucketss-doc-count-is-limit-to-3000/19225/2 "2014-08-12T13:27:22Z")
I am not sure to understand if your question is about aggregations or indexing speed? On Tue, Aug 12, 2014 at 11:24 AM, 陈浩 [humen1@gmail.com](mailto:humen1@gmail.com) wrote: > this is my DSL > > { > > > "query":{ > > "match\_all":{} > > }, > > > > ``` > > "aggs": { > > "range": { > > "date_range": { > > "field": "@timestamp", "format": > > > > ``` > > > > "yyy.MM.dd.HH.mm.ss", > > "ranges": [{"from": "2014.08.12.09.18.45", "to": > > "2014.08.12.09.20.50"}] > > }, > > "aggs": { > > "over\_time": { > > "date\_histogram": { > > "field": "@timestamp", > > "interval": "1s", > > "format": "yyy.MM.dd.HH.mm.ss" > > }, > > "aggs": { > > "total\_sent": { > > "sum": {"field": "bytes\_sent"} > > } > > } > > } > > } > > } > > } > > } > > thus is my result > > { > > - "took":6, > - "timed\_out":false, > - "\_shards":{ > - "total":96, > - "successful":96, > - "failed":0 > }, > > - "hits":{ > - "total":258002, > - "max\_score":0.0, > - "hits":[ > ] > }, > > - "aggregations":{ > - "range":{ > - "buckets":[ > - { > - "key":"2014.08.12.09.18.45-2014.08.12.09.20.50", > - "from":1.407835125E12, > - "from\_as\_string":"2014.08.12.09.18.45", > - "to":1.40783525E12, > - "to\_as\_string":"2014.08.12.09.20.50", > - "doc\_count":12000, > - "over\_time":{ > - "buckets":[ > - { > - "key\_as\_string":"2014.08.12.09.18.45", > - "key":1407835125000, > - "doc\_count":3000, > - "total\_sent":{ > - "value":6.6126308E7 > } > }, > > - { > - "key\_as\_string":"2014.08.12.09.18.47", > - "key":1407835127000, > - "doc\_count":3000, > - "total\_sent":{ > - "value":9.286586E7 > } > }, > > - { > - "key\_as\_string":"2014.08.12.09.18.49", > - "key":1407835129000, > - "doc\_count":3000, > - "total\_sent":{ > - "value":1.21316184E8 > } > }, > > - { > - "key\_as\_string":"2014.08.12.09.18.51", > - "key":1407835131000, > - "doc\_count":3000, > - "total\_sent":{ > - "value":8.3529544E7 > } > } > ] > } > } > ] > } > } > > } > > my soft flow is: > Nginx ==pipe==\> syslogng ==udp==\> logstash ==es\_river==\> elasticsearch > > How can I break the 3000doc/sec ? > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Adrien Grand -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j6kYQAU6ExwMFwxTuy3LQQx%2BLSh1\_-wNO7cxTd9GbF-Ow%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j6kYQAU6ExwMFwxTuy3LQQx%2BLSh1_-wNO7cxTd9GbF-Ow%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![11162](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/11162/32/1343_2.png) [@11162](https://discuss.elastic.co/u/11162)\ **Post date:** [August 12, 2014, 2:24pm UTC](https://discuss.elastic.co/t/why-my-bucketss-doc-count-is-limit-to-3000/19225/3 "2014-08-12T14:24:51Z")
indexing speed. 在 2014年8月12日，21:27，Adrien Grand [adrien.grand@elasticsearch.com](mailto:adrien.grand@elasticsearch.com) 写道： > I am not sure to understand if your question is about aggregations or indexing speed? > > On Tue, Aug 12, 2014 at 11:24 AM, 陈浩 [humen1@gmail.com](mailto:humen1@gmail.com) wrote: > this is my DSL > > { > "query":{ > "match\_all":{} > }, > > ``` > "aggs": { > "range": { > "date_range": { > "field": "@timestamp", "format": "yyy.MM.dd.HH.mm.ss", > "ranges": [{"from": "2014.08.12.09.18.45", "to": "2014.08.12.09.20.50"}] > }, > "aggs": { > "over_time": { > "date_histogram": { > "field": "@timestamp", > "interval": "1s", > "format": "yyy.MM.dd.HH.mm.ss" > }, > "aggs": { > "total_sent": { > "sum": {"field": "bytes_sent"} > } > } > } > } > } > } > } > > ``` > > thus is my result > > { > > "took":6, > > "timed\_out":false, > "\_shards":{ > > "total":96, > > "successful":96, > "failed":0 > > }, > "hits":{ > > "total":258002, > > "max\_score":0.0, > "hits":[ > > ] > }, > "aggregations":{ > > "range":{ > > "buckets":[ > > { > > "key":"2014.08.12.09.18.45-2014.08.12.09.20.50", > > "from":1.407835125E12, > "from\_as\_string":"2014.08.12.09.18.45", > > "to":1.40783525E12, > > "to\_as\_string":"2014.08.12.09.20.50", > > "doc\_count":12000, > "over\_time":{ > > "buckets":[ > > { > > "key\_as\_string":"2014.08.12.09.18.45", > > "key":1407835125000, > "doc\_count":3000, > > "total\_sent":{ > > "value":6.6126308E7 > } > > }, > { > > "key\_as\_string":"2014.08.12.09.18.47", > > "key":1407835127000, > "doc\_count":3000, > > "total\_sent":{ > > "value":9.286586E7 > } > > }, > { > > "key\_as\_string":"2014.08.12.09.18.49", > > "key":1407835129000, > "doc\_count":3000, > > "total\_sent":{ > > "value":1.21316184E8 > } > > }, > { > > "key\_as\_string":"2014.08.12.09.18.51", > > "key":1407835131000, > "doc\_count":3000, > > "total\_sent":{ > > "value":8.3529544E7 > } > > } > ] > } > } > ] > > } > } > } > > my soft flow is: > Nginx ==pipe==\> syslogng ==udp==\> logstash ==es\_river==\> elasticsearch > > How can I break the 3000doc/sec ? > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1fa43dda-31cd-4f10-95bc-0f31778d9663%40googlegroups.com). > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > Adrien Grand > > -- > You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/elasticsearch/qj4BP7rEnTU/unsubscribe](https://groups.google.com/d/topic/elasticsearch/qj4BP7rEnTU/unsubscribe). > To unsubscribe from this group and all its topics, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j6kYQAU6ExwMFwxTuy3LQQx%2BLSh1\_-wNO7cxTd9GbF-Ow%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j6kYQAU6ExwMFwxTuy3LQQx%2BLSh1_-wNO7cxTd9GbF-Ow%40mail.gmail.com). > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/EFF0A61B-AB24-4C8B-ABE2-A1B2D5FCC5AC%40gmail.com](https://groups.google.com/d/msgid/elasticsearch/EFF0A61B-AB24-4C8B-ABE2-A1B2D5FCC5AC%40gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:09am UTC](https://discuss.elastic.co/t/why-my-bucketss-doc-count-is-limit-to-3000/19225/4 "2017-07-06T01:09:09Z")