Number of buckets was exceeded.

[mrocaruano]

Hi,

I am encountering a issue when creating a visualization on one of my custom dashboards. I am getting the following error:

Does anyone have an idea where I can change the search.max_buckets setting?

Any help is appreciated, thanks!!

[dougburks]

Elastic usually has good reasons for these kinds of limitations. Before changing the setting, I'd recommend reviewing your visualization to see if there is any way to do it differently to avoid creating too many buckets.

[mrocaruano]

Thank you so much for the response. I'll take a look into that, If I do have to change the max bucket size, do I do that on the global.sls file?

[dougburks]

Elasticsearch configuration can be done per-node or in global.sls:
https://docs.securityonion.net/en/2.3/elasticsearch.html#configuration