Increase index.max_result_window

Graylog Central (peer support)
1

how can i increase index.max_result_window in graylog ? (3.3.4)
is there any command or place from where i can change limit ?

While retrieving data for this widget, the following error(s) occurred:

  • Elasticsearch limits the search result to 10000 messages. With a page size of 150 messages, you can use the first 66 pages. Search type returned error: Result window is too large, from + size must be less than or equal to: [10000] but was [23250]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max_result_window] index level setting.
2

@Justmfree I am happy to share you below Graylog FAQ documentation link which might help you to increase index.max_result_window value.

https://docs.graylog.org/en/3.3/pages/faq.html#i-cannot-go-past-page-66-in-search-results

Hope this helps you! :slight_smile:

3

thanks :slight_smile: i know this link… but there is no detail technical procedures how to increase :slight_smile:

4

@Justmfree You can configure index.max_result_window setting in your Elasticsearch cluster configuration i.e. /etc/elasticsearch/elasticsearch.yml. As you know that after taking an effect of new configuration you need to restart ES service.

I hope this clear your query. :slight_smile:

5

image.png
image.png763×553 14.6 KB

i tried but when i restart elasticsearch crashes. i guess this is not correct place because it is dynamic setting.? [
@makarands

6

@Justmfree Yes, you are right. The max_result_window is a dynamic index level setting, not node specific. The default is 10,000, so if that’s the value you’d like to set, there should be no need.

You can adjust it by updating either a specific index settings or globally across all existing indices:

PUT _settings
{
  "index.max_result_window": 11000
}

Else, you can take look at below ES guide link for more information.

https://www.elastic.co/guide/en/elasticsearch/reference/2.4/cluster-update-settings.html#cluster-update-settings

7

where from i can set this command ?
PUT _settings { “index.max_result_window”: 11000 }
@makarands makarand

8

On your Elastic server:
curl -XPUT -H 'Content-Type: application/json' -d '{"persistent": {"index.max_result_window": 11000 }}' 'http://127.0.0.1:9200/_cluster/settings'

9

tried but returned error:
{“error”:{“root_cause”:[{“type”:“illegal_argument_exception”,“reason”:“persistent setting [index.max_result_window], not recognized”}],“type”:“illegal_argument_exception”,“reason”:“persistent setting [index.max_result_window], not recognized”},“status”:400}

elast
elast990×85 26.2 KB

10

Try:
curl -XPUT -H 'Content-Type: application/json' -d '{"index": {"max_result_window": 20000 }}' 'http://127.0.0.1:9200/graylog_0/_settings'

This is only for the index graylog_0, you need to apply it on all the indexes you need.

If it doesn’t work, what is the version of ES ?

11

thanks @frantz it worked, may i ask ? how can i setup to apply this setting for future indexes as well automatically ?

ES version:

“name” : “AwMlPpn”,
“cluster_name” : “graylog”,
“cluster_uuid” : “u–dEU0MTQyfO4igsFCjGQ”,
“version” : {
“number” : “6.8.9”,
“build_flavor” : “oss”,
“build_type” : “rpm”,
“build_hash” : “be2c7bf”,
“build_date” : “2020-05-04T17:00:34.323820Z”,
“build_snapshot” : false,
“lucene_version” : “7.7.3”,
“minimum_wire_compatibility_version” : “5.6.0”,
“minimum_index_compatibility_version” : “5.0.0”
},
“tagline” : “You Know, for Search”

12

To update this setting on all existing indexes just do the same query on the URL http://127.0.0.1:9200/_settings

To apply it on all future indexes you need to create a template:
curl -XPUT -H 'Content-Type: application/json' -d '{"index_patterns": ["graylog_*"], "settings": {"index.max_result_window": 20000}}' 'http://127.0.0.1:9200/_template/template_1'

More info on https://stackoverflow.com/questions/55594386/where-should-i-configure-max-result-window-index-setting

13

thanks @frantz

i apply this:
curl -XPUT -H ‘Content-Type: application/json’ -d ‘{“index_patterns”: [“graylog_*”], “settings”: {“index.max_result_window”: 20000}}’ ‘http://127.0.0.1:9200/_template/template_1’

than i will look how it will works , thank you very much.

14

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.