[logging] Shard failures trying to search `json.tag: rails.application` in `pubsub-rails-inf-gprd`
The content of that tag is not structured, so a text search is necessary.
There are currently a lot of failures on queries like https://log.gprd.gitlab.net/goto/df7102d612189db2fb95d894becdcdd4.
Type
query_shard_exception
Reason
failed to create query: { "bool" : { "filter" : [ { "multi_match" : { "query" : "Successful Login", "fields" : [ ], "type" : "phrase", "operator" : "OR", "slop" : 0, "prefix_length" : 0, "max_expansions" : 50, "lenient" : true, "zero_terms_query" : "NONE", "auto_generate_synonyms_phrase_query" : true, "fuzzy_transpositions" : true, "boost" : 1.0 } }, { "match_phrase" : { "json.tag.keyword" : { "query" : "rails.application", "slop" : 0, "zero_terms_query" : "NONE", "boost" : 1.0 } } }, { "range" : { "json.time" : { "from" : null, "to" : null, "include_lower" : true, "include_upper" : true, "boost" : 1.0 } } } ], "adjust_pure_negative" : true, "boost" : 1.0 } }
Index uuid
kiWqJuLQRG-a6Rn9iBQMpQ
Index
pubsub-rails-inf-gprd-002303
Caused by type
illegal_argument_exception
Caused by reason
field expansion matches too many fields, limit: 1024, got: 1579
This is for a full 24 hours, but it seems reasonable to be able search in more than a few hours worth of data at a time.
Can the limit be raised or some other adjustment made to improve this?