Too_many_buckets_exception в Elasticsearch ⇐ JAVA

[Anonymous]

Я сталкиваюсь с проблемой в агрегации Elasticsearch. Мы используем Resthighlevelclient для запроса Elasticsearch в Java. < /p>

Исключение -< /p>


elasticsearchstatusexception [Elasticsearch Exception
[type = search_phase_execution_exception, sanage =]]; Вложенное:
elasticsearchexception [Elasticsearch Exception
[type = too_many_buckets_exception, причина = пытаться создать слишком много ведер
. Должно быть меньше или равна: [20000], но был [20001]. Этот предел
может быть установлен путем изменения [search.max_buckets] уровня кластера
setting.]]; < /P>
< /blockquote>

Я изменил search.max_buckets, используя запрос пута, но все же, я столкнулся с этой проблемой. {"Persistent": {
"search.max_buckets": 20000}} < /p>
< /blockquote>

Согласно нашим требованиям, сначала мы должны агрегировать данные на ежедневных основаниях, а затем почасовая основа. Агрегация будет выглядеть ниже уровня - < /p>

Day{
1:00[
{
ruleId : 1 ,
count : 20
},
{
ruleId : 2 ,
count : 25
}
],
2:00[
{
ruleId : 1 ,
count : 20
},
{
ruleId : 2 ,
count : 25
}
]
< /code>

Теперь мой код - < /p>

final List violationCaseMgmtDtos = new ArrayList();
try {
RangeQueryBuilder queryBuilders =
(end_timestmp > 0 ? customTimeRangeQueryBuilder(start_timestmp, end_timestmp, generationTime)
: daysTimeRangeQueryBuilder(14, generationTime));

BoolQueryBuilder boolQuery = new BoolQueryBuilder();
boolQuery.must(queryBuilders);
boolQuery.must(QueryBuilders.matchQuery("pvGroupBy", true));
boolQuery.must(QueryBuilders.matchQuery("pvInformation", false));
TopHitsAggregationBuilder topHitsAggregationBuilder =
AggregationBuilders.topHits("topHits").docValueField(policyId).sort(generationTime, SortOrder.DESC);

TermsAggregationBuilder termsAggregation = AggregationBuilders.terms("distinct").field(policyId).size(10000)
.subAggregation(topHitsAggregationBuilder);

DateHistogramAggregationBuilder timeHistogramAggregationBuilder =
AggregationBuilders.dateHistogram("by_hour").field("eventDateTime")
.fixedInterval(DateHistogramInterval.HOUR).subAggregation(termsAggregation);

DateHistogramAggregationBuilder dateHistogramAggregationBuilder =
AggregationBuilders.dateHistogram("by_day").field("eventDateTime")
.fixedInterval(DateHistogramInterval.DAY).subAggregation(timeHistogramAggregationBuilder);

SearchRequest searchRequest = new SearchRequest(violationDataModel);
SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder();
searchSourceBuilder.aggregation(dateHistogramAggregationBuilder);
searchSourceBuilder.query(boolQuery);
searchSourceBuilder.from(offset);
searchSourceBuilder.size(10000);
searchRequest.source(searchSourceBuilder);
SearchResponse searchResponse = null;

searchResponse = restHighLevelClient.search(searchRequest, RequestOptions.DEFAULT);

ParsedDateHistogram parsedDateHistogram = searchResponse.getAggregations().get("by_day");

parsedDateHistogram.getBuckets().parallelStream().forEach(dayBucket -> {

ParsedDateHistogram hourBasedData = dayBucket.getAggregations().get("by_hour");

hourBasedData.getBuckets().parallelStream().forEach(hourBucket -> {

// TimeLine timeLine = new TimeLine();
String dateTime = hourBucket.getKeyAsString();
// long dateInLong = DateUtil.getMiliSecondFromStringDate(dateTime);
// timeLine.setViolationEventTime(dateTime);

ParsedLongTerms distinctPolicys = hourBucket.getAggregations().get("distinct");
distinctPolicys.getBuckets().parallelStream().forEach(policyBucket -> {

DTO violationCaseManagementDTO = new DTO();
violationCaseManagementDTO.setDataAggregated(true);
violationCaseManagementDTO.setEventDateTime(dateTime);
violationCaseManagementDTO.setRuleId(Long.valueOf(policyBucket.getKey().toString()));

ParsedTopHits parsedTopHits = policyBucket.getAggregations().get("topHits");
SearchHit[] searchHits = parsedTopHits.getHits().getHits();
SearchHit searchHit = searchHits[0];

String source = searchHit.getSourceAsString();
ViolationDataModel violationModel = null;
try {
violationModel = objectMapper.readValue(source, ViolationDataModel.class);
} catch (Exception e) {
e.printStackTrace();
}

violationCaseManagementDTO.setRuleName(violationModel.getRuleName());
violationCaseManagementDTO.setGenerationTime(violationModel.getGenerationTime());
violationCaseManagementDTO.setPriority(violationModel.getPriority());
violationCaseManagementDTO.setStatus(violationModel.getViolationStatus());
violationCaseManagementDTO.setViolationId(violationModel.getId());
violationCaseManagementDTO.setEntity(violationModel.getViolator());
violationCaseManagementDTO.setViolationType(violationModel.getViolationEntityType());
violationCaseManagementDTO.setIndicatorsOfAttack( (int)
(policyBucket.getDocCount() * violationModel.getNoOfViolatedEvents()));
violationCaseMgmtDtos.add(violationCaseManagementDTO);

});
// violationCaseMgmtDtos.sort((d1,d2) -> d1.getEventDateTime().compareTo(d2.getEventDateTime()));
});

});

List realtimeViolation = findViolationWithoutGrouping(start_timestmp, end_timestmp, offset, size);
realtimeViolation.stream().forEach(action -> violationCaseMgmtDtos.add(action));
} catch (Exception e) {
e.printStackTrace();
}

if (Objects.nonNull(violationCaseMgmtDtos) && violationCaseMgmtDtos.size() > 0) {
return violationCaseMgmtDtos.stream()
.filter(violationDto -> Objects.nonNull(violationDto))
.sorted((d1,d2) -> d2.getEventDateTime().compareTo(d1.getEventDateTime()))
.collect(Collectors.toList());
}
return violationCaseMgmtDtos;
}
< /code>

Пожалуйста, помогите мне решить эту проблему. < /p>

Подробнее здесь: https://stackoverflow.com/questions/582 ... sticsearch