Max_result_window increase problem

Graylog Central (peer support)
1

Hello,
I have problem with change “max_result_window” on Graylog 4.2.8.

I changed all of my indices (where # = 1-12) with this command:
curl -XPUT “http://localhost:9200/graylog_#/_settings” -d ‘{ “index” : { “max_result_window” : 500000 } }’ -H “Content-Type: application/json”
but after this I tried to search something and got this error:

Zrzut ekranu z 2022-05-04 11-21-25
Zrzut ekranu z 2022-05-04 11-21-25863×203 22.6 KB

When I check current setting with this command:
curl -XGET localhost:9200/graylog_#/_settings
I can see that value of max_result_window in all indices is “500000”.

2

Hello && Welcome

I would like to help you but… With the lack of information given I’m not able to help you any further.
Just a side note increasing the max_result_window to 500000 is not a good idea, This would result in lots of issues.
To help you further please take a look at this post.

3

Ok, I changed value from 500000 to 50000 for all indices. I still got this same error. What additional information I need to provide?

4

I found solution: after I used this command:
curl -XPUT “http://localhost:9200/_all/_settings” -d ‘{ “index” : { “max_result_window” : 50000 } }’ -H “Content-Type: application/json”
I am able to see more than 10k logs.

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.