Search settings

The following expert settings can be set to manage global search and aggregation limits.

indices.query.bool.max_clause_count

Deprecated in 8.0.0

This deprecated setting has no effect.

(Static, integer) Elasticsearch will now dynamically set the maximum number of allowed clauses in a query, using a heuristic based on the size of the search thread pool and the size of the heap allocated to the JVM. This limit has a minimum value of 1024 and will in most cases be larger (for example, a node with 30Gb RAM and 48 CPUs will have a maximum clause count of around 27,000). Larger heaps lead to higher values, and larger thread pools result in lower values.

Queries with many clauses should be avoided whenever possible. If you previously bumped this setting to accommodate heavy queries, you might need to increase the amount of memory available to Elasticsearch, or to reduce the size of your search thread pool so that more memory is available to each concurrent search.

In previous versions of Lucene you could get around this limit by nesting boolean queries within each other, but the limit is now based on the total number of leaf queries within the query as a whole and this workaround will no longer help.

search.max_buckets

(Dynamic, integer) Maximum number of aggregation buckets allowed in a single response. Defaults to 65,536.

Requests that attempt to return more than this limit will return an error.

search.aggs.only_allowed_metric_scripts

(Dynamic, boolean) Configures whether only explicitly allowed scripts can be used in scripted metrics aggregations. Defaults to false.

Requests using scripts not contained in either search.aggs.allowed_inline_metric_scripts or search.aggs.allowed_stored_metric_scripts will return an error.

search.aggs.allowed_inline_metric_scripts

(Dynamic, list of strings) List of inline scripts that can be used in scripted metrics aggregations when search.aggs.only_allowed_metric_scripts is set to true. Defaults to an empty list.

Requests using other inline scripts will return an error.

search.aggs.allowed_stored_metric_scripts

(Dynamic, list of strings) List of ids of stored scripts that can be used in scripted metrics aggregations when search.aggs.only_allowed_metric_scripts is set to true. Defaults to an empty list.

Requests using other stored scripts will return an error.

indices.query.bool.max_nested_depth

(Static, integer) Maximum nested depth of queries. Defaults to 30.

This setting limits the nesting depth of queries. Deep nesting of queries may lead to stack overflow errors.

The following search settings are supported:

search.aggs.rewrite_to_filter_by_filter

Search task watchdog settings

The search task watchdog monitors long-running search tasks and logs hot threads when thresholds are exceeded. This helps diagnose slow searches by capturing threads activity while the search is still running, rather than just logging after completion.

On data nodes, the watchdog logs hot threads when a shard-level search operation (query/fetch phase) exceeds the data node threshold. On coordinator nodes, it logs hot threads for long-running coordinator search tasks only when they have no outstanding shard child requests. This avoids redundant logging when the coordinator is simply waiting for slow shards, which log their own hot threads.

The hot threads output is gzip compressed and base64-encoded. To decode it, use:

echo "<base64-data>" | base64 --decode | gzip --decompress

If the output is split across multiple log lines, concatenate them first.

search.task_watchdog.enabled: (Dynamic, boolean) Enables or disables the search task watchdog. Defaults to false.

search.task_watchdog.coordinator_threshold: (Dynamic, time value) Threshold for coordinator tasks. When a search task on the coordinator node exceeds this duration and has no outstanding shard child requests, hot threads are logged. Set to -1ms to disable coordinator task monitoring. Defaults to 3s.

search.task_watchdog.data_node_threshold: (Dynamic, time value) Threshold for data node shard tasks. When a shard-level search operation (query or fetch phase) exceeds this duration, hot threads are logged. Set to -1ms to disable data node task monitoring. Defaults to 3s.

search.task_watchdog.interval: (Dynamic, time value) How frequently the watchdog checks for slow tasks. Lower values detect slow tasks sooner but consume more resources. Minimum value is 100ms. Defaults to 1s.

search.task_watchdog.cooldown_period: (Dynamic, time value) Minimum time between hot threads logging on this node. This prevents flooding the logs when many tasks are slow simultaneously. Defaults to 30s.