elasticsearch runtime_error ai_generated true

SearchPhaseExecutionException: all shards failed: [search_phase_execution_exception] Reason: Timed out after [30000ms] while waiting for search results

ID: elasticsearch/search-phase-execution-timeout

Also available as: JSON · Markdown · 中文
80%Fix Rate
85%Confidence
1Evidence
2025-03-22First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
elasticsearch 7.17 active — — —
elasticsearch 8.10 active — — —
elasticsearch 8.12 active — — —

Root Cause

The search request timed out because one or more shards took longer than the configured timeout to respond, often due to slow queries or resource contention.

generic

中文

搜索请求超时，因为一个或多个分片响应时间超过了配置的超时时间，通常是由于慢查询或资源争用。

Official Documentation

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-timeout.html

Workarounds

  1. 80% success Increase the search timeout for specific requests: POST /my_index/_search { "timeout": "60s", "query": { "match": { "field": "value" } } } 
    Increase the search timeout for specific requests: POST /my_index/_search { "timeout": "60s", "query": { "match": { "field": "value" } } }
  2. 85% success Optimize the query by adding index filters or reducing aggregation complexity: use 'filter' context instead of 'query' for non-scoring filters, and limit 'size' and 'aggs'. 
    Optimize the query by adding index filters or reducing aggregation complexity: use 'filter' context instead of 'query' for non-scoring filters, and limit 'size' and 'aggs'.
  3. 90% success Use async search for long-running queries: POST /my_index/_async_search { "size": 0, "query": { "match_all": {} }, "aggs": { "my_agg": { "terms": { "field": "field", "size": 10000 } } }, "wait_for_completion_timeout": "10s" } 
    Use async search for long-running queries: POST /my_index/_async_search { "size": 0, "query": { "match_all": {} }, "aggs": { "my_agg": { "terms": { "field": "field", "size": 10000 } } }, "wait_for_completion_timeout": "10s" }

中文步骤

  1. 增加特定请求的搜索超时时间：POST /my_index/_search { "timeout": "60s", "query": { "match": { "field": "value" } } }
  2. 通过添加索引过滤器或减少聚合复杂度来优化查询：对非评分过滤器使用 'filter' 上下文而非 'query'，并限制 'size' 和 'aggs'。
  3. 对长时间运行的查询使用异步搜索：POST /my_index/_async_search { "size": 0, "query": { "match_all": {} }, "aggs": { "my_agg": { "terms": { "field": "field", "size": 10000 } } }, "wait_for_completion_timeout": "10s" }

Dead Ends

Common approaches that don't work:

  1. 60% fail

    This only delays the failure; slow queries still consume resources and may eventually cause cluster instability.

  2. 75% fail

    This changes the search semantics and returns inaccurate results, breaking application functionality.

  3. 70% fail

    Restarting does not fix the underlying slow query or resource issue; the timeout will recur after the cluster recovers.