Skip to content

ES|QL with large QueryDSL filters can OOM #143164

@craigtaverner

Description

@craigtaverner

We've seen an issue recently with a user that had an ES|QL query that includes a QueryDSL filter that contains a geo_shape filter doing a within check on a very large polygon (eg. the border of an entire country). This results in OperatorStatus.processedQueries map containing very large keys. The heap dump analysis showed a path to the memory that looked like:

  • compute.operator.OperatorStatus
    • compute.lucene.LuceneOperator$Status
      • processedQueries
        • TreeMap
          • root
            • key

ImageImage

We should investigate if the processedQueries needs to maintain the full polygon information here, or if this could be replaced by a hashcode instead. Also, check that this is protected by a circuit-breaker.

Metadata

Metadata

Assignees

No one assigned

    Labels

    :Analytics/ES|QLAKA ESQL:Analytics/GeoIndexing, search aggregations of geo points and shapes>bugTeam:AnalyticsMeta label for analytical engine team (ESQL/Aggs/Geo)

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions