Linux docker 启动Kibana失败：Data too large

关注

VIP免费原创最新推荐文章于 2026-07-15 13:24:21 发布 1.4k 阅读 AI 写同款· GEO 优化 ›

Rocky Linux 8下高可用SIEM部署：Suricata+Filebeat+Elastic实战指南 SIEM（安全信息与事件管理）是现代企业威胁感知的核心基础设施，其本质是实现日志采集、标准化解析、实时索引与智能告警的端到端闭环。技术原理上依赖高效的数据管道（如Filebeat直采替代Logstash）、内存敏感的存储引擎（Elasticsearch ILM策略应对OOM风险）以及操作系统级安全机制协同（如SELinux策略适配）。在Rocky Linux 8这一主流生产环境上，其强化的SELinux策略、systemd-oomd内存管控和eBPF支持深度，直接决定SIEM链路的稳定性与吞吐上限。典型应用阅读详情

FATAL [circuit_breaking_exception] [parent] Data too large, data for [<http_request>] would be [250592200/246.0mb], which is larger than the limit of [246546432/235.1mb], real usage: [250592200/246.0mb], new bytes reserved: [0/0b], usages [request=16512/16.1kb, fielddata=11330/11kb, in_flight_requests=0/0b, accounting=7160235/6.8mb], with { bytes_wanted=250592200 & bytes_limit=246546432 & durability="PERMANENT" } :: {"path":"/.kibana","query":{},"statusCode":429,"response":"{\"error\":{\"root_cause\":[{\"type\":\"circuit_breaking_exception\",\"reason\":\"[parent] Data too large, data for [<http_request>] would be [250592200/246.0mb], which is larger than the limit of [246546432/235.1mb], real usage: [250592200/246.0mb], new bytes reserved: [0/0b], usages [request=16512/16.1kb, fielddata=11330/11kb, in_flight_requests=0/0b, accounting=7160235/6.8mb]\",\"bytes_wanted\":250592200,\"bytes_limit\":246546432,\"durability\":\"PERMAN