Graylog2 / Graylog2/graylog2-server

Search broken when message offset is over 10000

Open
#3,571 9 comments 0 reactions 0 assignees View on GitHub
bug elasticsearch triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When you search with a Message offset over 10000 you will get this no answer, only the serverlog shows this:
```
2017-03-06T11:00:48.897+01:00 WARN [SearchResource] Unable to execute search: all shards failed
```

Same as when you change multiple times the page back then you get this:

![chrome_2017-03-06_11-04-04](https://cloud.githubusercontent.com/assets/15243394/23605361/b4344f9e-025c-11e7-90d1-e13a38596374.png)

And the serverlog shows this:
```
2017-03-06T11:00:48.897+01:00 WARN [SearchResource] Unable to execute search: all shards failed
```
## Expected Behavior
Get Messages after offset 10000

## Current Behavior
Failes

## Possible Solution
it's not the same as: #2306 because i dont get the ES error, but maybe it helps?

## Steps to Reproduce (for bugs)
1. search in the gui
2. change pages until you get the error
or
1. search with the api
2. get no messages

## Context
we tried to do something like tail -f with the api but when we hit offsett 10000 it dies.

## Your Environment
Graylog 2.2.0+d9681cb on syslog.xyz.local (Oracle Corporation 1.8.0_121 on Linux 3.10.0-327.22.2.el7.x86_64)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.