# Max\_result\_window increase Graylog 4.0.5+d95b909 **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [April 9, 2021, 9:16am UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419 "2021-04-09T09:16:42Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 9, 2021, 9:16am UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/1 "2021-04-09T09:16:42Z")
Hello. An error appears when I going to page 67. What can be done in this case? Type of error: **While retrieving data for this widget, the following error(s) occurred:** - Elasticsearch exception [type=illegal\_argument\_exception, reason=Result window is too large, from + size must be less than or equal to: [10000] but was [10050]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max\_result\_window] index level setting.]. Version: Graylog 4.0.5+d95b909 Thank You for attention. Regards, Nusultan ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 9, 2021, 10:41am UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/2 "2021-04-09T10:41:40Z")
Hi @Tomcat7 you can try to increase the value to this setting like: ```auto curl -XPUT "http://localhost:9200/my_index/_settings" -d '{ "index" : { "max_result_window" : 50000 } }' -H "Content-Type: application/json" ``` ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [April 10, 2021, 4:57am UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/3 "2021-04-10T04:57:22Z")
@Tomcat7 What @reimlima stated should do the trick but be careful about deep paging. > **[Pagination | Elasticsearch: The Definitive Guide \[2.x\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/guide/current/pagination.html)** ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 10, 2021, 7:34pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/4 "2021-04-10T19:34:51Z")
Hello @Reimlima I tried to enter command, but I received an error: “{“error”:{“root\_cause”:[{“type”:“index\_not\_found\_exception”,“reason”:“no such index [my\_index]”,“resource.type”:“index\_or\_alias”,“resource.id”:“my\_index”,“index\_uuid”:“_na_”,“index”:“my\_index”}],“type”:“index\_not\_found\_exception”,“reason”:“no such index [my\_index]”,“resource.type”:“index\_or\_alias”,“resource.id”:“my\_index”,“index\_uuid”:“_na_”,“index”:“my\_index”},“status”:404}[root@srv ~]#” ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 10, 2021, 7:39pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/5 "2021-04-10T19:39:20Z")
Also found this issue: > [graylog: Set max\_result\_window to 10000000 on graylog template by paladox · Pull Request #1678 · miraheze/puppet · GitHub](https://github.com/miraheze/puppet/pull/1678/commits/bee891e8c4df6e78a0b290695f6382fc40fb5da8) But I don’t understand how to fix this problem. ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 11, 2021, 12:09am UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/6 "2021-04-11T00:09:23Z")
Hi @Tomcat7 Sorry, that command was just an example. You need to change “my\_index” to the real index name, which must be something like “graylog\_#” Where “#” is the number of your index, this number changes after every rotation, you need to take a look in your Graylog UI to know which is. ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 11, 2021, 8:22pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/7 "2021-04-11T20:22:06Z")
Hello @Reimlima I was unable to find the index in the Graylog UI. Why do I need to specify port 9200? I usually log into the Graylog via browser ([http://10.1.1.214:9000](http://10.1.1.214:9000)) Thank You for attention. Regards, Nursultan. ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 11, 2021, 8:37pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/8 "2021-04-11T20:37:40Z")
I’m so sorry for my “facepalm” questions ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 11, 2021, 8:38pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/9 "2021-04-11T20:38:23Z")
Hi, > I’m so sorry for my “facepalm” questions Not a problem at all! There’s no “facepalm question”, not asking when you’re in doubt that deserves “facepalm” The changes I’m sugesting you to do need to be done directly in elasticsearch, that’s why “port 9200”, it’s the port normally elasticsearch listen to. [You can run a simillar “curl” command to list all your indexes](https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-indices.html), could be an alternative to Graylog UI. ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 12, 2021, 2:06pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/10 "2021-04-12T14:06:50Z")
Hello @Reimlima And yet, I could not find the index. “Curl” command can’t list indexes. ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 12, 2021, 5:32pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/11 "2021-04-12T17:32:10Z")
Hi, can you feed me with more informations? Like: - The curl command you’re running - The error it shows you. ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 13, 2021, 5:50am UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/12 "2021-04-13T05:50:12Z")
Hello @Reimlima I entered command and got an error Commands: 1. curl -X GET “localhost:9200/\_cat/indices/my-index-\*?v=true&s=index&pretty” 2. GET /\_cat/indices/my-index-_?v=true&s=index Error: [root@srv ~]# GET /\_cat/indices/my-index-_?v=true&s=index [1] 16825 -bash: GET: command not found [root@srv ~]# curl -X GET "localhost:9200/\_cat/indices/my-index-_?v=true&s=index&pretty" health status index uuid pri rep docs.count docs.deleted store.size pri.store.size [1]+ Exit 127 GET /\_cat/indices/my-index-_?v=true ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 13, 2021, 10:12am UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/13 "2021-04-13T10:12:46Z")
Hi @Tomcat7 Pleas, run the command this way and paste the output here: ```auto curl -s -XGET "localhost:9200/_cat/indices" ``` ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 13, 2021, 2:23pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/14 "2021-04-13T14:23:30Z")
The command works great. Output: green open gl-events\_1 UI\_OHJpTQQi708dv56dlZg 4 0 0 0 832b 832b green open gl-events\_0 8JfheYc4SG6Dev1-8Qy87A 4 0 0 0 832b 832b green open graylog\_0 St9y1SncQqecG4HcmC4d0Q 4 0 14392069 0 2.5gb 2.5gb green open gl-system-events\_0 yEIPXzaHTQCftb4N9hoxIQ 4 0 0 0 832b 832b green open gl-system-events\_1 AZb2QZV6R2a9AZ8xxr2kvA 4 0 0 0 832b 832b ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 13, 2021, 2:25pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/15 "2021-04-13T14:25:11Z")
> [@reimlima](#): > > `curl -XPUT "http://localhost:9200/my_index/_settings" -d '{ "index" : { "max_result_window" : 50000 } }' -H "Content-Type: application/json"` Also entered: curl -XPUT “localhost:9200/graylog\_0/\_settings” -d ‘{ “index” : { “max\_result\_window” : 50000 } }’ -H “Content-Type: application/json” Output: no errors At the moment I can go to page 67,68,69 etc Thank You very much @Reimlima. It works very well. ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 13, 2021, 4:17pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/16 "2021-04-13T16:17:17Z")
@Tomcat7 Glad to hear that, just for notice, the index you’re looking for is: > [@Tomcat7](#): > > graylog\_0 Updating my first reply, the command in your end would be like that: ```sh curl -XPUT "http://localhost:9200/graylog_0/_settings" -d '{ "index" : { "max_result_window" : 50000 } }' -H "Content-Type: application/json" ``` ---
**Author:** ![Tomcat7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tomcat7/32/9652_2.png) [@Tomcat7](https://community.graylog.org/u/Tomcat7)\ **Post date:** [April 13, 2021, 4:26pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/17 "2021-04-13T16:26:18Z")
Entered the command and system accepted. Works very well))) Thank You very much Regards, Nursultan. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [April 27, 2021, 4:26pm UTC](https://community.graylog.org/t/max-result-window-increase-graylog-4-0-5-d95b909/19419/18 "2021-04-27T16:26:33Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.