Skip to content

Commit 17389d2

Browse files
authored
ESQL docs: Warn about huge response (#101568)
Add a warning about huge response sizes. Closes #101490
1 parent a233043 commit 17389d2

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

docs/reference/esql/esql-kibana.asciidoc

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
++++
77

88
You can use {esql} in {kib} to query and aggregate your data, create
9-
visualizations, and set up alerts.
9+
visualizations, and set up alerts.
1010

1111
This guide shows you how to use {esql} in Kibana. To follow along with the
1212
queries, load the "Sample web logs" sample data set by clicking *Try sample
@@ -72,7 +72,7 @@ following query is identical to the previous one:
7272

7373
[source,esql]
7474
----
75-
FROM kibana_sample_data_logs
75+
FROM kibana_sample_data_logs
7676
| LIMIT 10
7777
----
7878

@@ -82,7 +82,7 @@ bar:
8282

8383
image::images/esql/esql-expanded-query-bar.png[align="center"]
8484

85-
To return to a compact query bar, click the minimize editor button
85+
To return to a compact query bar, click the minimize editor button
8686
(image:images/esql/esql-icon-minimize-query-bar.svg[]).
8787

8888
[discrete]
@@ -253,4 +253,9 @@ quick statistics for that field.
253253
of rows that are retrieved by the query and displayed in Discover. Any query or
254254
aggregation runs on the full data set.
255255
* Discover shows no more than 50 columns. If a query returns
256-
more than 50 columns, Discover only shows the first 50.
256+
more than 50 columns, Discover only shows the first 50.
257+
* Querying many many indices at once without any filters can cause an error in
258+
kibana which looks like `[esql] > Unexpected error from Elasticsearch: The
259+
content length (536885793) is bigger than the maximum allowed string (536870888)`.
260+
The response from {esql} is too long. Use <<esql-drop>> or <<esql-keep>> to limit the number
261+
of fields returned.

0 commit comments

Comments
 (0)