Does Timelion enforce its own term aggregation size limit for high-cardinality fields?

Direct Answer

No. Timelion does not enforce its own global term aggregation size limit for high-cardinality fields. The bucket count is driven by the size argument you supply via the split function and by Elasticsearch cluster limits such as search.max_buckets and circuit breaker settings. index.max_result_window controls the search hit window, not aggregation buckets.

How bucket size is actually controlled

• Per‑series control: Use split='field:N' in a Timelion expression (e.g., .es(split=user:10)) to set the size parameter on the generated terms aggregation. When N is omitted, a small default (typically 5‑10) is used.
• Cluster limits: Elasticsearch enforces search.max_buckets (default 10,000) and request circuit breakers. A request that exceeds these limits fails regardless of the split value.
• No global Timelion setting: There is no Kibana/Timelion option that imposes a uniform cap across all sheets; each expression decides its own bucket size.

Version sensitivity

Timelion was deprecated in Kibana 7.x and removed in 8.x. Defaults, request shaping, and even the presence of the Timelion UI differ by major release. If you are on Kibana 7.x the behavior above applies; on 8.x+ Timelion is unavailable and you should use Lens or Vega visualizations instead.

Verification steps

1. Open browser DevTools → Network tab.
2. Load a Timelion sheet that uses split.
3. Find the _msearch or _search request sent to Elasticsearch.
4. Inspect the request body: locate the terms aggregation and confirm the size field matches the N from your split argument.
5. Vary N (e.g., 5, 50, 200) and verify the returned bucket count respects the requested size, up to Elasticsearch limits.

One diagnostic detail needed

What Kibana major version are you running? This determines whether Timelion is present, which defaults apply, and whether you should migrate to Lens or Vega instead.