ES常见问题处理

1、默认1000分片不足

PUT /_cluster/settings
{
  "transient":{
    "cluster":{
      "max_shards_per_node":10000
    }
  }
}

2、数据检索最多10000条

PUT /sys-log-keyoperation/_settings
{
  "index.max_result_window": "2000000000"
}

3、时间相差8小时

4、超过了默认的桶配置

报错：
{ “error”: { “root_cause”: [], “type”: “search_phase_execution_exception”, “reason”: “”, “phase”: “fetch”, “grouped”: true, “failed_shards”: [], “caused_by”: { “type”: “too_many_buckets_exception”, “reason”: “Trying to create too many buckets. Must be less than or equal to: [10000] but was [10001]. This limit can be set by changing the [search.max_buckets] cluster level setting.”, “max_buckets”: 10000 } }, “status”: 503 }
解决方案：

PUT /_cluster/settings
{
  "persistent": {
    "search.max_buckets": 2000000000
  }
}