存储桶过多，在直方图上聚合失败 [英] Too many buckets, aggregation fails on histogram

问题描述

我要查询的Elastic包含总共8个嵌套聚合，所有聚合都是 term 聚合，除了一个是 histogram 聚合.如果我删除该直方图聚合，查询将完美运行.但是，使用直方图聚合时，会抛出此特定错误:

I have a query to elastic that contains total 8 nested aggregations, all aggregations are term aggregations except one which is a histogram aggregation. If I remove that histogram aggregation, the query runs perfectly. But with histogram aggregation it is throwing this particular error:

此聚合会创建过多的存储桶(10001)，并且会抛出一个未来版本中出现错误.您应该更新[search.max_buckets]集群设置或使用[composite]聚合对所有页面进行分页存储多个请求.

This aggregation creates too many buckets (10001) and will throw an error in future versions. You should update the [search.max_buckets] cluster setting or use the [composite] aggregation to paginate all buckets in multiple requests.

现在，我尝试增加 max_buckets 的大小，但该大小已达到100000以上，并且该数字不确定，因此该选项已退出.然后，我尝试按照错误中的建议创建一个 composite 聚合，但这在添加直方图时也出现了相同的错误.

Now I tried increasing the max_buckets size but the size is reaching above 100000 and also that number is not certain so that option is out. Then I tried creating a composite aggregation as suggested in the error but that is also giving the same error with the histogram added.

所以我的问题是我是否以某种错误的方式编写查询，或者弹性不足以创建那么多存储桶?

So my question is am I writing the queries in some wrong fashion or elastic is not feasible enough to create that much of buckets?

Kibana查询:(只有3个嵌套层，原始问题只有8个嵌套层)

Kibana query: (with only 3 levels of nesting, original problem have 8)

GET /project/test/_search
{
    "query": {
        "bool": {
            "must": [
                {
                "range": {
                    "date" : {
                        "gte": 20180101,
                        "lte": 20180630
                        }
                    }
                }
            ]
        }
    },
    "size": 0,
    "aggs": {
        "agg1": {
            "terms": {
                "field": "agg1"
            },
            "aggs": {
                "agg2": {
                    "terms": {
                        "field": "agg2"
                    },
                    "aggs": {
                        "agg3": {
                            "histogram": {
                                "field": "agg3",
                                "interval": 1
                            }
                        }
                    }
                }
            }   
        }
    }
}

推荐答案

您可以执行此操作以将群集设置(search.max_buckets)更改为更大. https://www.elastic.co/guide/zh-CN/elasticsearch/reference/current/cluster-update-settings.html

You can do this to change your cluster setting (search.max_buckets) larger. https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-update-settings.html

PUT _cluster/settings
{
  "persistent": {
    "search.max_buckets": 50000
  }
}

这篇关于存储桶过多，在直方图上聚合失败的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！