Kibana查询ES报错：[parent] Data too large, data for [＜http_request＞] would be [25720845544/23.9gb]

Kibana报错：

{"type":"error","@timestamp":"2020-09-27T05:26:12Z","tags":["warning","stats-collection"],
"pid":426971,"level":"error","error":{"message":"[circuit_breaking_exception]
 [parent] Data too large, data for [<http_request>] would be [25712457296/23.9gb],
 which is larger than the limit of [24481313587/22.7gb], real usage: [25712456936/23.9gb],
 new bytes reserved: [360/360b], usages

解决：

vim  /config/elasticsearch.yml

# 缓存回收大小，无默认值
# 有了这个设置，最久未使用（LRU）的 fielddata 会被回收为新数据腾出空间
# 控制fielddata允许内存大小，达到HEAP 20% 自动清理旧cache
indices.fielddata.cache.size: 20%
indices.breaker.total.use_real_memory: false
# fielddata 断路器默认设置堆的 60% 作为 fielddata 大小的上限。
indices.breaker.fielddata.limit: 40%
# request 断路器估算需要完成其他请求部分的结构大小，例如创建一个聚合桶，默认限制是堆内存的 40%。
indices.breaker.request.limit: 40%
# total 揉合 request 和 fielddata 断路器保证两者组合起来不会使用超过堆内存的 70%(默认值)。
indices.breaker.total.limit: 95%

或者

PUT /_cluster/settings
{
  "persistent": {
    "indices.breaker.fielddata.limit": "60%"
  }
} 


PUT /_cluster/settings
{
  "persistent": {
    "indices.breaker.request.limit": "40%"
  }
} 


PUT /_cluster/settings
{
  "persistent": {
    "indices.breaker.total.limit": "70%"
  }
} 

 

参考文档：

1、https://blog.csdn.net/weixin_42166515/article/details/89093832

2、ES官网限制内存使用：https://www.elastic.co/guide/cn/elasticsearch/guide/current/_limiting_memory_usage.html