Hello,
when trying to create the alert and using the Alert test this is the output.
data:Object
meta:Object
request:Object
method:"POST"
url:["https://lxxxxx.eu-central-1.bonsaisearch.net:443/_msearch?max_concurrent_shard_requests=5"](https://lmstats-testing-9447597387.eu-central-1.bonsaisearch.net/_msearch?max_concurrent_shard_requests=5)
data:"{"ignore_unavailable":true,"index":"my-index-000001","search_type":"query_then_fetch"} {"aggs":{"4":{"aggs":{"2":{"aggs":{"1":{"extended_stats":{"field":"Status","sigma":1}}},"date_histogram":{"field":"RcvTime","interval":"1m","min_doc_count":0,"extended_bounds":{"min":"1598211535062","max":"1598297935062"},"format":"epoch_millis"}}},"terms":{"field":"PlayerName.keyword","size":500,"order":{"_count":"desc"},"min_doc_count":0}}},"query":{"bool":{"filter":{"range":{"RcvTime":{"format":"epoch_millis","gte":"1598211535062","lte":"1598297935062"}}}}},"size":0} "
response:Object
status:200
data:Object
responses:Array[1]
0:Object
error:Object
caused_by:Object
max_buckets:10000
reason:"Trying to create too many buckets. Must be less than or equal to: [10000] but was [10001]. This limit can be set by changing the [search.max_buckets] cluster level setting."
type:"too_many_buckets_exception"
failed_shards:Array[0]
grouped:true
phase:"fetch"
reason:""
root_cause:Array[0]
type:"search_phase_execution_exception"
status:503
took:8
series:Array[0]
2:Object
message:"Condition: Eval: false, Query Returned No Series (reduced to null/no value)"
data:null
Alerting doesnt respect values set in the Panel Querry.
In the alert request:
min_doc_count:0
While in my settings as you can see min doc count is set to 1 to avoid this.
This causes the issue. I tried to call the ES endpoint directly after editing the request myself and it worked.