Graylog 4.2 Result window is too large: is there a way to use search_after?

Hello.

1. Describe your incident:
When going through a search results, i tried to see the results on the last page, but got this error:

2. Describe your environment:

  • OS Information: Ubuntu 20.04 LTS

  • Package Version: Graylog 4.2.13+9c90b93

  • Elasticsearch version: 7.10.2

3. What steps have you already taken to try and solve the problem?

I have checked on the community here, stackoverflow, medium and others, but the most recurrent solution is to increase the max_result_window index.
But, it is specified that it is not a good idea.
I have checked elasticsearch documentation, and it is said to use the search_after parameter to get more results.
I also saw some custom queries that can be used in a console and even some programs that could help for deep pagination.

However, i haven’t seen any sample of code to integrate with Graylog to implement deep pagination.

4. How can the community help?

So i would like to ask, if there is a way to use deep pagination with Graylog without increasing the max_result_window index?
Can you help me with an example? Or can you point me to a possible solution?

Thank you.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Hey @arms001

OpenSearch API

As for Graylog , I’m not sure. Only idea I know of is to reduce you parameter search.

Ok, thanks for your help.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.