OpenSearch exception [type=too_many_nested_clauses, reason=Query contains too many nested clauses; maxClauseCount is set to 1024]

Graylog Central (peer support)
1

When I try to use simple Query like “openvpn” AND “connected”, I get this error:

OpenSearch exception [type=too_many_nested_clauses, reason=Query contains too many nested clauses; maxClauseCount is set to 1024].

I used to use this query earlier and it worked.

Graylog 6.0.5
Openseach 2.16.0
Lucene 9.11.1

Has anyone had this problem?

2

Hey @royalstar

The “easy” way out is to increase the indices.query.bool.max_clause_count limit in the configuration file to a higher value.
I think it used to be 1024 in ES 7 and now in ES 8 it has been raised to 4096.

Just be aware that doing so might harm the performance of your cluster and even bring nodes down depending on your data volume.

3

Thank you @gsmith.
What is actual problem here and how to solve it right way?

4

hey @royalstar

OpenSearch is the issue.
The issue was found here

5

Will downgrading Opensearch solve the problem?

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.