[context view] using the _uid field as a tiebreaker consumes a lot of fielddata memory

[weltenwort]

The current query mechanism for the context view utilize the search_after query parameter in combination with sorting on the index pattern's time field and the _uids. Since _uids do not yet support docvalues (elastic/elasticsearch#11887), this fills up the fielddata cache very quickly and trips the circuit breaker for indices with many documents.

[damm]

So I think I ran into this the other day; I don't really want to open a new issue as it seems this is fresh.

I have a lot of fields to begin with; (say 15,000) so I am sure that doesn't help.

P.S. I'm referring to the 'View Surrounding Documents'. If this issue isn't related please let me know so I can open a new issue.

Thanks!

P.S. I didn't have any monitoring enabled when I killed my cluster with this feature; it survived this time but it seems to have kept a bunch of the data still loaded in field data... so I have to restart the cluster to get back down to 9gig heap in use.

[weltenwort]

@damm Yes, this is the same effect. Sorry for the delayed response.

[jpountz]

I opened elastic/elasticsearch#25240.