[Visualize] Offering terms-agg on timestamp fields is a footgun? OOM potential. #59188
Labels
enhancement
New value added to drive a business result
Feature:Visualizations
Generic visualization features (in case no more specific feature label is available)
Team:Visualizations
Visualization editors, elastic-charts and infrastructure
We currently let users configure visualizations with a
terms
aggregation on a millisecond-resolution date field. This can cause memory problems given the number of unique values.Is this analysis ever useful? I suspect the cluster-killing costs outweigh the number of edge cases where it is useful (it would need a very selective query to reduce the number of matches). Most of the time I imagine users actually want a date histogram rather than a terms agg.
Would it make sense to remove this sort of selection in the visualization config UI?
The text was updated successfully, but these errors were encountered: