Elasticsearch large queries die with empty reply: heap, not the query

Elasticsearch large queries die with empty reply: heap, not the query

TL;DR

[accepted answer]: this is Elasticsearch running out of heap: it cannot hold all the documents in memory, and it dies silently with no explicit error code. Beyond adding memory, three workarounds: 1. Tell Elastic to skip the document body with "_source": false in the query.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

You get back just the hits/ids, then fetch documents individually. 2. Use source filtering to return only the fields you need (_source includes just those fields), which shrinks each hit. 3. Split the query into smaller chunks or use the scroll API to page through large result sets instead of one giant request. If large result sets consistently kill the node, the real fix is heap sizing: give the JVM enough memory (up to ~50% of RAM, never more) and reduce per-request payload with the options above.

Context: Stack Overflow #35921195 (accepted answer, 50 votes): Elasticsearch queries return "curl: (52) Empty reply from server" or time out, but only when the expected result set is large. Small queries work fine, and there is no explicit error from the cluster.

Source: Stack Overflow #35921195 (accepted answer, 50 votes): Elasticsearch queries return "curl: (52) Empty reply from server" or time out, but only when the expected result set is large. Small queries work fine, and there is no explicit error from the cluster.

Verified resolution: [accepted answer]: this is Elasticsearch running out of heap: it cannot hold all the documents in memory, and it dies silently with no explicit error code. Beyond adding memory, three workarounds: 1. Tell Elastic to skip the document body with "source": false in the query. You get back just the hits/ids, then fetch documents individually. 2. Use source filtering to return only the fields you need (source includes just those fields), which shrinks each hit. 3. Split the query into smaller chunks or use the scroll API to page through large result sets instead of one giant request. If large result sets consistently kill the node, the real fix is heap sizing: give the JVM enough memory (up to ~50% of RAM, never more) and reduce per-request payload with the options above.

Source URL: https://stackoverflow.com/questions/35921195