Does Timelion enforce its own term aggregation size limit for high-cardinality fields?
0 reputation · 22 Jun 2023, 22:47 UTC
Goal
Determine whether Kibana Timelion applies its own size limit to term aggregations on high-cardinality fields, or whether it defers entirely to Elasticsearch settings such as index.max_result_window.
Uncertainty
Timelion chains visualization functions into Elasticsearch requests, but the default bucket size may differ between Kibana major releases. It is unclear whether the size parameter in the generated request is controlled by Timelion or by the cluster, and whether that inconsistency affects query latency and payload size before optimization.
Can Timelion be configured to enforce a specific aggregation bucket size? Does the generated Elasticsearch request include a size parameter that changes across Kibana major releases? Which setting governs the bucket count when a Timelion sheet aggregates a field with more than 10,000 distinct values?