The following expert settings can be set to manage global search and aggregation limits.
[8.0.0] Deprecated in 8.0.0. (Static, integer) This deprecated setting has no effect.
Elasticsearch will now dynamically set the maximum number of allowed clauses in a query, using a heuristic based on the size of the search thread pool and the size of the heap allocated to the JVM. This limit has a minimum value of 1024 and will in most cases be larger (for example, a node with 30Gb RAM and 48 CPUs will have a maximum clause count of around 27,000). Larger heaps lead to higher values, and larger thread pools result in lower values.
Queries with many clauses should be avoided whenever possible. If you previously bumped this setting to accommodate heavy queries, you might need to increase the amount of memory available to Elasticsearch, or to reduce the size of your search thread pool so that more memory is available to each concurrent search.
In previous versions of Lucene you could get around this limit by nesting boolean queries within each other, but the limit is now based on the total number of leaf queries within the query as a whole and this workaround will no longer help.
(Dynamic, integer) Maximum number of aggregation buckets allowed in a single response. Defaults to 65,536.
Requests that attempt to return more than this limit will return an error.
(Static, integer) Maximum nested depth of bool queries. Defaults to
This setting limits the nesting depth of bool queries. Deep nesting of boolean queries may lead to stack overflow.
Intro to Kibana
ELK for Logs & Metrics