elasticsearch
query_error
ai_generated
true
ElasticsearchException：聚合[my_agg]超过了最大大小[10000]
ElasticsearchException: The aggregation [my_agg] exceeded the max size of [10000]
ID: elasticsearch/aggregation-max-size-exceeded
85%修复率
87%置信度
1证据数
2024-09-05首次发现
版本兼容性
| 版本 | 状态 | 引入 | 弃用 | 备注 |
|---|---|---|---|---|
| elasticsearch 7.15.0 | active | — | — | — |
| elasticsearch 8.8.0 | active | — | — | — |
| elasticsearch 8.13.0 | active | — | — | — |
根因分析
terms聚合请求的size参数超过了默认的最大大小限制10000。
English
A terms aggregation request has a size parameter larger than the default max size limit of 10000.
官方文档
https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html解决方案
-
动态增加最大大小限制：PUT _cluster/settings { "transient": { "search.max_buckets": 20000 } } -
将聚合size减少到10000或更少，并对更大数据集使用composite聚合进行分页。
-
使用过滤聚合缩小结果集，例如在聚合前添加查询过滤器。
无效尝试
常见但无效的做法:
-
60% 失败
Size 0 is treated as unlimited, but can cause memory overflow and is deprecated in newer versions.
-
90% 失败
The cluster-level max size limit still applies; the error persists unless the limit is raised.
-
40% 失败
Composite aggregation has its own limits and may not be suitable for all use cases.