ElasticSearch｜too_many_buckets_exception解决方法

报错信息

ES 执行聚合查询时报错，报错信息如下：

{"root_cause": []"type": "search_phase_execution_exception","reason": "","phase": "fetch","grouped": true,"failed_shareds": [],"caused_by": {"type": "too_many_buckets_exception","reason": "Trying to create too many buckets. Must be less than or equal to: [65535] but was [65536]. This limit can be set by changing the [search.max_buckets] cluster level sitting.""max_buckets": 65535}
}

原因定位

因为聚合查询的桶数超过了 ES 集群配置的最大桶数的上限。ES 聚合查询最大桶数的参数文档如下（地址）：

search.max_buckets

(Dynamic, integer) Maximum number of aggregation buckets allowed in a single response. Defaults to 65,536.

Requests that attempt to return more than this limit will return an error.

解决方案

1. 调整聚合查询方法，使用其他方法实现查询
2. 修改 ES 集群配置的最大桶数上限

PUT /_cluster/settings
{"persistent" : {"search.max_buckets" : 1000000}
}