elasticsearch runtime_error ai_generated true

查询阶段执行异常：结果窗口过大，from + size 必须小于等于 [10000]，但实际为 [50000]

QueryPhaseExecutionException: Result window is too large, from + size must be less than or equal to: [10000] but was [50000]

ID: elasticsearch/max-clause-count-exceeded

其他格式: JSON · Markdown 中文 · English
85%修复率
88%置信度
1证据数
2024-03-15首次发现

版本兼容性

版本状态引入弃用备注
elasticsearch 7.17 active — — —
elasticsearch 8.11 active — — —
elasticsearch 8.12 active — — —

根因分析

搜索请求中 'from' 和 'size' 参数的组合超过了 'index.max_result_window' 设置，导致查询执行失败。

English

The combination of 'from' and 'size' parameters in a search request exceeds the 'index.max_result_window' setting, causing query execution to fail.

generic

官方文档

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-from-size.html

解决方案

  1. 使用 search_after 配合排序实现基于游标的分页，避免 from+size 限制。示例：POST /my_index/_search { "size": 10, "sort": [ { "date": "asc" } ], "search_after": [ "2024-01-01T00:00:00" ] }
  2. 临时提高特定索引的 index.max_result_window：PUT /my_index/_settings { "index.max_result_window": 50000 }
  3. 在 ES 7.10+ 中使用 point-in-time (PIT) 和 search_after 实现稳定的深度分页：POST /my_index/_pit?keep_alive=1m 然后 POST /_search { "pit": { "id": "...", "keep_alive": "1m" }, "size": 100, "sort": [ { "_shard_doc": "asc" } ], "search_after": [ ... ] }

无效尝试

常见但无效的做法:

  1. 60% 失败

    Excessive increase can cause severe memory pressure and OOM on coordinating nodes, especially with deep pagination.

  2. 70% 失败

    Scroll is designed for deep pagination but not for random access; it requires maintaining context and doesn't support from+size directly.

  3. 80% 失败

    This suppresses total hit count but doesn't resolve the from+size limit; the error persists if from+size still exceeds max_result_window.