I can't see the data in the dashboard. It always appears No results found, but there is data with te filters applied. I have seen in the Response tab and I get
"reason":"ElasticsearchException[org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [@timestamp] would be larger than limit of [623326003/594.4mb]];
How could I change this limit for being able to visualize all the visualizations in the dashboard?
I have used "cat /proc/meminfo" to see how is my RAM, and I have
MemTotal: 8059268 kB
MemFree: 141872 kB
Buffers: 183700 kB
Cached: 5532044 kB
SwapCached: 460 kB
Active: 2624192 kB
Inactive: 4740612 kB
Active(anon): 793784 kB
Inactive(anon): 855316 kB
Active(file): 1830408 kB
Inactive(file): 3885296 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 1572860 kB
SwapFree: 1569772 kB
Dirty: 5296 kB
Writeback: 0 kB
AnonPages: 1648660 kB
Mapped: 586712 kB
Shmem: 40 kB
Slab: 462420 kB
SReclaimable: 398560 kB
SUnreclaim: 63860 kB
KernelStack: 4944 kB
PageTables: 12192 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 5602492 kB
Committed_AS: 2018216 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 29564 kB
VmallocChunk: 34359701040 kB
HardwareCorrupted: 0 kB
AnonHugePages: 1499136 kB
I think that I have too much in the cache. I have left the default parameters for ES_MIN_MEM , ES_MAX_MEM and ES_HEAP_SIZE.. Now my question is... I should change the ES_HEAP_SIZE to the 50% of the total RAM memory? (4 GB) or only 50% of the free memory? (141872 kB /2 = 70MB aprox)
