Add safeguards to prevent simple user errors (original) (raw)

There are a number of places where a naive user can break Elasticsearch very easily. We should add more (dynamically overridable) safeguards that prevent users from hurting themselves.

Note:

• We are adding high limits to start so that we don't suddenly disable things that users already do today, but so that sysadmins have tools that they can use to protect their clusters. We can revisit the limits later on.
• All these settings should be prefixed by policy. to make them easier to document together and to understand their purpose.

Accepted limits:

• Hard limit on from/size #9311 Hard limit on from/size
• Add global search timeout setting #12149 Global default value for search timeouts (Could be ridiculously high like an hour and it would still help)
• Disable fielddata on text fields by defaults. #17386 Disable fielddata-loading on analyzed text fields by default (Adrien)
• Add a soft limit on the number of shards that can be queried in a single search request. #17396 Limit the max number of shards to 1000 (Adrien)
• Limit request size #17133 Limit the size of all in-flight requests (Daniel)
• Add limit to total number of fields in mapping #17357 Limit the number of fields that can be added to a mapping to 1000
• Add a soft limit on the mapping depth. #17400 Add maximum mapping depth to 20
• Add sane limits for thread size and queue size (Jim)
• Add a maximum search request size. #26423 Don't allow search requests greater than (eg) 10MB (Adrien)
• Set soft limit on the number of nested fields per index #14983 Limit the number of nested fields per index to 50 (Yannick)
• Very large windows_size can cause node to run OOM #17522 Limit window_size in rescore API (@nik9000)
• Disable script access to _source by default #17558 Disable script access to _source fields by default
• Relocating many shards at once results in canceled relocations #18739 Limit the number of shards that can be rerouted at the same time
• Add a limit to from + size in top_hits and inner hits. #26492 Hard limit on from/size in top hits and inner hits (much smaller than a normal query) (MVG)
• Circuit break the number of inline scripts compiled per minute #19694 Limit script compilation rate to avoid hard coding of params in scripts
• Hard limit on total number of shards in a cluster #20705 Max number of shards per node (enforced as total shards per cluster)
• Limit index creation rate #20760 Limit index creation rate
• Limit the timeout of scroll requests #23268 Add upper limit for scroll expiry time (Jim)
• Add a soft limit on the number of requested doc-value and script fields #26390 Add upper limit for the number of requested doc-values fields (Christoph)

For discussion:

• Add a switch to disallow slow queries #29050 Disable certain query types, eg wildcard, span etc?
• Improve circuit breaking on aggregations #14046 Limit on the number of buckets returned by aggs
• Include hits in request circuit breaker #9310 Limit the size of the response (eg for very large doc bodies)
• Kill slow scripts when search timeout has lapsed aka while(true) should not require a rolling restart to recover from Don't run a script a second time when the first execution takes longer than 1 second
• Disable searching across all indices #6470 Disable searching on all indices by default Handled by max number of shards
• Limit the number nested Lucene documents per document. Limit the number of nested documents #26962

Any other ideas?