How to fix CircuitBreakingException: [request] Data too large in Elasticsearch

# Check circuit breaker settings
curl -X GET "localhost:9200/_nodes/stats/breaker" -u "username:password"

# Check JVM heap usage
curl -X GET "localhost:9200/_nodes/stats/jvm" -u "username:password"

# Check fielddata memory usage
curl -X GET "localhost:9200/_nodes/stats/indices/fielddata" -u "username:password"

# Example response showing circuit breaker information:
{
  "nodes": {
    "node-id": {
      "breakers": {
        "request": {
          "limit_size": "6.4gb",
          "limit_size_in_bytes": 6871947673,
          "estimated_size": "5.2gb",
          "estimated_size_in_bytes": 5583457484,
          "overhead": 1.0,
          "tripped": 3
        }
      }
    }
  }
}

// BEFORE: Memory-intensive query
{
  "size": 10000,
  "query": { "match_all": {} },
  "aggs": {
    "all_terms": {
      "terms": {
        "field": "user_id.keyword",
        "size": 10000  // Too many buckets
      }
    }
  }
}

// AFTER: Optimized query with limits
{
  "size": 100,  // Reduce result size
  "query": {
    "range": {
      "timestamp": {
        "gte": "now-1h"  // Add time range
      }
    }
  },
  "aggs": {
    "sampled_terms": {
      "terms": {
        "field": "user_id.keyword",
        "size": 100,  // Reasonable bucket limit
        "execution_hint": "map"  // Use map execution
      }
    }
  }
}

// Use search_after for deep pagination instead of large 'size'
{
  "size": 100,
  "sort": [{"timestamp": "desc"}, {"_id": "asc"}],
  "search_after": [1640995200000, "doc-id-123"]
}

# In elasticsearch.yml
indices.breaker.request.limit: 60%  # Default is 60% of heap
indices.breaker.fielddata.limit: 40%  # Default is 40% of heap
indices.breaker.total.limit: 70%  # Default is 70% of heap

# For specific use cases, you can increase:
indices.breaker.request.limit: 70%
indices.breaker.fielddata.limit: 50%

# Or set absolute values
indices.breaker.request.limit: 8gb

# Update settings dynamically (doesn't require restart)
curl -X PUT "localhost:9200/_cluster/settings" -u "username:password" -H 'Content-Type: application/json' -d'
{
  "persistent": {
    "indices.breaker.request.limit": "70%",
    "indices.breaker.fielddata.limit": "50%"
  }
}
'

# Verify the update
curl -X GET "localhost:9200/_cluster/settings" -u "username:password"

// Mapping optimization for text fields
PUT /my-index
{
  "mappings": {
    "properties": {
      "product_name": {
        "type": "text",
        "fields": {
          "keyword": {
            "type": "keyword",
            "doc_values": true,  # Use doc_values instead of fielddata
            "ignore_above": 256
          }
        }
      },
      "category": {
        "type": "keyword",  # keyword fields use doc_values by default
        "doc_values": true
      },
      "description": {
        "type": "text",
        "fielddata": false  # Explicitly disable fielddata
      }
    }
  }
}

// Clear fielddata cache if it's consuming too much memory
POST /my-index/_cache/clear?fielddata=true

// Check fielddata memory usage by field
GET /_cat/fielddata?v&fields=*

// Limit fielddata circuit breaker
PUT /_cluster/settings
{
  "persistent": {
    "indices.breaker.fielddata.limit": "30%"
  }
}

# Monitor circuit breaker trips
curl -X GET "localhost:9200/_nodes/stats/breaker?filter_path=**.tripped" -u "username:password"

# Monitor heap usage
curl -X GET "localhost:9200/_nodes/stats/jvm?filter_path=**.heap_*" -u "username:password"

# Set up alerting with Elasticsearch alerts or external monitoring
# Example: Alert when circuit breaker trips exceed threshold

# Check for memory-intensive shards
GET /_cat/shards?v&h=index,shard,prirep,state,docs,store,ip&s=store:desc

# Identify indices consuming the most memory
GET /_cat/indices?v&h=index,docs.count,store.size,pri.store.size&s=store.size:desc

# Example monitoring configuration
# Use Elastic Stack monitoring or external tools like:
# - Prometheus with Elasticsearch exporter
# - Datadog Elasticsearch integration
# - New Relic Elasticsearch plugin

monitoring:
  enabled: true
  collection:
    interval: 10s

xpack:
  monitoring:
    enabled: true
    elasticsearch:
      collection:
        enabled: true
        interval: 10s

# Increase heap size (elasticsearch.yml)
# Recommended: 50% of available RAM, not exceeding 32GB
-Xms16g
-Xmx16g

# Adjust thread pool sizes
thread_pool:
  search:
    size: 10  # Adjust based on CPU cores
    queue_size: 1000

# Consider adding more nodes to distribute load
# Horizontal scaling is often better than vertical scaling

# Use dedicated coordinating nodes for heavy search loads
node.roles: [coordinating_only]

# Use dedicated data nodes
node.roles: [data]

# Use dedicated master nodes
node.roles: [master]

# Check current node roles
GET /_cat/nodes?v&h=name,node.role,heap.percent,ram.percent,cpu

# Consider index lifecycle management for time-series data
# Move old indices to colder, cheaper storage
PUT _ilm/policy/hot_warm_cold
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "30d"
          }
        }
      },
      "warm": {
        "min_age": "30d",
        "actions": {
          "allocate": {
            "number_of_replicas": 1
          }
        }
      },
      "cold": {
        "min_age": "90d",
        "actions": {
          "allocate": {
            "number_of_replicas": 0
          }
        }
      }
    }
  }
}