Too_many_buckets_Exception в elasticsearch ⇐ JAVA

[Anonymous]

Я столкнулся с проблемой агрегации ElasticSearch. Мы используем RestHighLevelClient для запроса ElasticSearch в Java.

Исключением является -


ElasticsearchStatusException [исключение Elasticsearch
[тип =search_phase_execution_Exception, причина=]]; вложенный:
ElasticsearchException [Исключение Elasticsearch
[type=too_many_buckets_Exception, Reason=Попытка создать слишком много
сегментов. Должно быть меньше или равно: [20000], но было [20001]. Это
ограничение можно установить, изменив настройку уровня кластера [search.max_buckets]
.]];


Я изменил search.max_buckets с помощью запроса PUT, но все равно столкнулся с этой проблемой.


PUT /_cluster/settings { "persistent " : {
"search.max_buckets":20000 }


Согласно нашему требованию, сначала мы должны агрегировать данные ежедневно, затем ежечасно, затем по правилу. Агрегация будет выглядеть ниже уровня -

Код: Выделить всё

Day{
1:00[
{
ruleId : 1 ,
count : 20
},
{
ruleId : 2 ,
count : 25
}
],
2:00[
{
ruleId : 1 ,
count : 20
},
{
ruleId : 2 ,
count : 25
}
]

Теперь мой код —

Код: Выделить всё

    final List violationCaseMgmtDtos = new ArrayList();
try {
RangeQueryBuilder queryBuilders =
(end_timestmp > 0 ? customTimeRangeQueryBuilder(start_timestmp, end_timestmp, generationTime)
: daysTimeRangeQueryBuilder(14, generationTime));

BoolQueryBuilder boolQuery = new BoolQueryBuilder();
boolQuery.must(queryBuilders);
boolQuery.must(QueryBuilders.matchQuery("pvGroupBy", true));
boolQuery.must(QueryBuilders.matchQuery("pvInformation", false));
TopHitsAggregationBuilder topHitsAggregationBuilder =
AggregationBuilders.topHits("topHits").docValueField(policyId).sort(generationTime, SortOrder.DESC);

TermsAggregationBuilder termsAggregation = AggregationBuilders.terms("distinct").field(policyId).size(10000)
.subAggregation(topHitsAggregationBuilder);

DateHistogramAggregationBuilder timeHistogramAggregationBuilder =
AggregationBuilders.dateHistogram("by_hour").field("eventDateTime")
.fixedInterval(DateHistogramInterval.HOUR).subAggregation(termsAggregation);

DateHistogramAggregationBuilder dateHistogramAggregationBuilder =
AggregationBuilders.dateHistogram("by_day").field("eventDateTime")
.fixedInterval(DateHistogramInterval.DAY).subAggregation(timeHistogramAggregationBuilder);

SearchRequest searchRequest = new SearchRequest(violationDataModel);
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
searchSourceBuilder.aggregation(dateHistogramAggregationBuilder);
searchSourceBuilder.query(boolQuery);
searchSourceBuilder.from(offset);
searchSourceBuilder.size(10000);
searchRequest.source(searchSourceBuilder);
SearchResponse searchResponse = null;

searchResponse = restHighLevelClient.search(searchRequest, RequestOptions.DEFAULT);

ParsedDateHistogram parsedDateHistogram = searchResponse.getAggregations().get("by_day");

parsedDateHistogram.getBuckets().parallelStream().forEach(dayBucket -> {

ParsedDateHistogram hourBasedData = dayBucket.getAggregations().get("by_hour");

hourBasedData.getBuckets().parallelStream().forEach(hourBucket -> {

// TimeLine timeLine = new TimeLine();
String dateTime = hourBucket.getKeyAsString();
// long dateInLong = DateUtil.getMiliSecondFromStringDate(dateTime);
// timeLine.setViolationEventTime(dateTime);

ParsedLongTerms distinctPolicys = hourBucket.getAggregations().get("distinct");
distinctPolicys.getBuckets().parallelStream().forEach(policyBucket ->  {

DTO violationCaseManagementDTO = new DTO();
violationCaseManagementDTO.setDataAggregated(true);
violationCaseManagementDTO.setEventDateTime(dateTime);
violationCaseManagementDTO.setRuleId(Long.valueOf(policyBucket.getKey().toString()));

ParsedTopHits parsedTopHits = policyBucket.getAggregations().get("topHits");
SearchHit[] searchHits = parsedTopHits.getHits().getHits();
SearchHit searchHit = searchHits[0];

String source = searchHit.getSourceAsString();
ViolationDataModel violationModel = null;
try {
violationModel = objectMapper.readValue(source, ViolationDataModel.class);
} catch (Exception e) {
e.printStackTrace();
}

violationCaseManagementDTO.setRuleName(violationModel.getRuleName());
violationCaseManagementDTO.setGenerationTime(violationModel.getGenerationTime());
violationCaseManagementDTO.setPriority(violationModel.getPriority());
violationCaseManagementDTO.setStatus(violationModel.getViolationStatus());
violationCaseManagementDTO.setViolationId(violationModel.getId());
violationCaseManagementDTO.setEntity(violationModel.getViolator());
violationCaseManagementDTO.setViolationType(violationModel.getViolationEntityType());
violationCaseManagementDTO.setIndicatorsOfAttack( (int)
(policyBucket.getDocCount() * violationModel.getNoOfViolatedEvents()));
violationCaseMgmtDtos.add(violationCaseManagementDTO);

});
//  violationCaseMgmtDtos.sort((d1,d2) -> d1.getEventDateTime().compareTo(d2.getEventDateTime()));
});

});

List realtimeViolation = findViolationWithoutGrouping(start_timestmp,  end_timestmp,  offset,  size);
realtimeViolation.stream().forEach(action -> violationCaseMgmtDtos.add(action));
} catch (Exception e) {
e.printStackTrace();
}

if (Objects.nonNull(violationCaseMgmtDtos) && violationCaseMgmtDtos.size() > 0) {
return violationCaseMgmtDtos.stream()
.filter(violationDto -> Objects.nonNull(violationDto))
.sorted((d1,d2) -> d2.getEventDateTime().compareTo(d1.getEventDateTime()))
.collect(Collectors.toList());
}
return violationCaseMgmtDtos;
}

Помогите мне решить эту проблему.

Подробнее здесь: https://stackoverflow.com/questions/582 ... sticsearch