Search page (Log Table Widget) pagination stops changing the page contents after a certain number of pages

[drewmiranda-gl]

When using the pagination for a Message Table widget, the contents of the message table stop changing. In the example I recorded below I hit a limit at page 66.

video1417418887.mp4

Expected Behavior

Either pagination does not show pages that cannot be viewed, or pagination for the applicable page shows the proper log messages

Current Behavior

Pagination breaks after a certain number of pages.

Possible Solution

Steps to Reproduce (for bugs)

Context

https://community.graylog.org/t/absolute-date-range-not-working/33769

Your Environment

• Graylog Version: 6.0.7
• Java Version: Bundled
• OpenSearch Version: 2.15.0
• MongoDB Version: 7.0.14
• Operating System: Ubuntu Server 22.04 LTS
• Browser version: Safari

Please let me know if there are any questions.

[linuspahl]

This might be related to #18947, can you check if the response for the last request (/api/views/searchjobs/.../.../status) contains an error like this one?

[drewmiranda-gl]

Yep! That's exactly it:

{
    "execution": {
        "done": true,
        "cancelled": false,
        "completed_exceptionally": true
    },
    "errors": [
        {
            "type": "result_window_limit",
            "description": "Result window is too large, [from + size] must be less than or equal to: [10000]. This limit can be set by changing the [index.max_result_window] index level setting, but it is recommended to use more advanced methods in order to get distant chunks of results (i.e. scroll or search after)",
            "search_type_id": "1ab94da5-0d53-4f72-b3dd-7fd4bbc4309a",
            "result_window_limit": 10000,
            "query_id": "f61480d0-217d-4e88-b73c-7a34963e4a19"
        }
    ]
}

[drewmiranda-gl]

Thinking more about this, opened a FR that is related, though we can still fix this as well as implement the proposed FR:

#20717

[spardok]

Same exact issue
Graylog Version: 6.0.6 and 6.1.8
Java Version: bundled
Datanode Version: 6.0.6 and 6.1.8
MongoDB Version: 7.0.11
OS: Ubuntu 22.04 LTS
Browser: FF/Chrome

This is running as a Docker Compose

[drewmiranda-gl]

interesting bit of feedback from heather is that she says this behavior was not present prior to maybe 6.0 (not exactly sure on the version). Could this be true?

[ryan-carroll-graylog]

Reopening this issue as the main problem was not fully address in #22311
See: https://github.com/Graylog2/support/issues/206#issuecomment-2979140220