ES/ElasticSearch 聚合查询时报错：too

环境：ElasticSearch6.7
问题描述：

{
	"error": {
		"root_cause": [],
		"type": "search_phase_execution_exception",
		"reason": "",
		"phase": "fetch",
		"grouped": true,
		"failed_shards": [],
		"caused_by": {
			"type": "too_many_buckets_exception",
			"reason": "Trying to create too many buckets. Must be less than or equal to: [65535] but was [2191545]. This limit can be set by changing the [search.max_buckets] cluster level setting.",
			"max_buckets": 65535
		}
	},
	"status": 503
}

这是6.x版本才有的特性，目的：限制大批量聚合操作，规避性能风险。

• 解决方案

1. setting里设置：search.max_buckets ，设置大一点够用就行

PUT /_cluster/settings
{"persistent": {"search.max_buckets": 200000}}

2. 或者增加查询条件避免过多的数据聚合查询（比如增加开始结束时间等）

• 说明

因为它在这个分片上找到的条目超过了限定的条数（限定1000实际有2000个）这时候不管你设不设size，哪怕size=1都会报错！

官网地址：
https://www.elastic.co/guide/en/elasticsearch/reference/master/search-aggregations-bucket.html