在做es的聚合查询时，当数据基数非常大，或者查询语句不合理会导致es的查询很吃力，甚至出现以下错误。但有时候确实需要这么查询，这个时候需要修改max_buckets的阈值。

{
    "error": {
        "root_cause": [],
        "type": "search_phase_execution_exception",
        "reason": "",
        "phase": "fetch",
        "grouped": true,
        "failed_shards": [],
        "caused_by": {
            "type": "too_many_buckets_exception",
            "reason": "Trying to create too many buckets. Must be less than or equal to: [65535] but was [2191545]. This limit can be set by changing the [search.max_buckets] cluster level setting.",
            "max_buckets": 65535
        }
    },
    "status": 503
}

 

通过 GET /_cluster/settings 可以查看max_buckets的阈值

{
  "persistent" : {
    "search" : {
      "max_buckets" : "1000000"
    },
    "xpack" : {
      "monitoring" : {
        "collection" : {
          "enabled" : "true"
        }
      }
    }
  },
  "transient" : {
    "search" : {
      "max_buckets" : "1000000"
    }
  }
}

通过

PUT /_cluster/settings
{
  "persistent": {
    "search.max_buckets": 1000000
  }
}

以及

PUT /_cluster/settings
{
  "transient": {
    "search.max_buckets": 1000000
  }
}

来设置max_buckets。