报错信息

ES 执行聚合查询时报错，报错信息如下：

{
    
    
    "root_cause": []
    "type": "search_phase_execution_exception",
    "reason": "",
    "phase": "fetch",
    "grouped": true,
    "failed_shareds": [],
    "caused_by": {
    
    
        "type": "too_many_buckets_exception",
        "reason": "Trying to create too many buckets. Must be less than or equal to: [65535] but was [65536]. This limit can be set by changing the [search.max_buckets] cluster level sitting."
        "max_buckets": 65535
    }
}

原因定位

因为聚合查询的桶数超过了 ES 集群配置的最大桶数的上限。ES 聚合查询最大桶数的参数文档如下（地址）：

search.max_buckets

(Dynamic, integer) Maximum number of aggregation buckets allowed in a single response. Defaults to 65,536.

Requests that attempt to return more than this limit will return an error.

解决方案

1. 调整聚合查询方法，使用其他方法实现查询
2. 修改 ES 集群配置的最大桶数上限

PUT /_cluster/settings
{
  "persistent" : {
    "search.max_buckets" : 1000000
  }
}