10000 messages Elasticsearch limits in Graylog

[elpedrop (Hook)]

hi everyone,
i have a problem in Graylog with Elasticsearch limits the search result to 10000 messages.

how can I resolve that ?

Many many thanks
Peter.

[ttsandrew]

Increase index.max_result_window Graylog 3.3.1

hello i have this error message : what is efficient way to permanently increase “index.max_result_window” for old and for new Indices ? While retrieving data for this widget, the following error(s) occurred: Elasticsearch limits the search result to 10000 messages. With a page size of 150 messages, you can use the first 66 pages. Search type returned error: Result window is too large, from + size must be less than or equal to: [10000] but was [40641900]. See the scroll api for a more efficie…

Increase index.max_result_window

how can i increase index.max_result_window in graylog ? (3.3.4) is there any command or place from where i can change limit ? While retrieving data for this widget, the following error(s) occurred: Elasticsearch limits the search result to 10000 messages. With a page size of 150 messages, you can use the first 66 pages. Search type returned error: Result window is too large, from + size must be less than or equal to: [10000] but was [23250]. See the scroll api for a more efficient way to re…

https://docs.graylog.org/en/4.0/pages/faq.html#i-cannot-go-past-page-66-in-search-results

[elpedrop (Hook)]

@elpedrop

how can I resolve that ?

how can I resolve that ? . any help for me ? any idea ?
i try this ,
graylog:/etc/elasticsearch# curl -XPUT “https://ip:9000/my_index/_settings 215” -d ‘{ “index” : { “max_result_window” : 5000000 } }’
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to ip:9000

many thanks
peter

[ttsandrew]

It looks like you’re pasting literal ‘ip’, 9000 isn’t the port, or HTTPS isn’t enabled so it’s unable to connect.

[elpedrop (Hook)]

@elpedrop

Elasticsearch limits the search result to 10000 messages

I have checked and I don’t have https configured. How do I configure my https in graylog?

[elpedrop (Hook)]

i try to configure to https and then in openssl-graylog.cnf

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req --> mistake —why ?
prompt = no

openssl-graylog.cnf Error Loading extension section v3_req

[ttsandrew]

The documentation for enabling HTTPS in Graylog is here, it’s got everything you need:

Securing Graylog — Graylog 4.0.0 documentation

However, the change you’re making is to Elasticsearch. You’re receiving an error that it can’t connect to ip:9000 with SSL. That can mean that the IP address is wrong, the port is wrong, or HTTPS is not available. You should check your connection information.

[ttsandrew]

Correction, information about HTTPS is here

Using HTTPS — Graylog 4.0.0 documentation

[elpedrop (Hook)]

hi everybody,

when I try to configure the server.conf file, the problem I have with my version of graylog 3.2.6 is that I can’t find where to configure the https?

rest_listen_uri =http://ip:12900/ -> in my version 3.2.6 can I configure that? Its possible ?
web_listen_uri =http://ip:9000/ > in my version 3.2.6 can I configure that? Its possible ?

note : I dont have graylog 4.0.0.

many many thanks,
Peter

[aaronsachs]

@elpedrop, my suggestion for the purpose of this post would be that you keep on topic–work with folks to solve the issue you originally raised, and if you need help enabling HTTPS for your systems, start another post. Mixing topics makes it difficult for folks to help solve an issue and from what I can tell, seems like it may lead this topic down a bit of a rabbit hole.

[elpedrop (Hook)]

@aaronsachs

my suggestion for the purpose of this post would be that you keep on topic–work with folks to solve the issue you originally raised, and if you need help enabling HTTPS for your systems, start another post. Mixing topics makes it difficult for folks to help solve an issue and from what I can tell, seems like it may lead this topic down a bit of a rabbit hole.

thanks ,
I open another topic