This is a message indicating that we are throttling the rate at which a search process reads event raw data (the _raw field) to keep the memory usage of the search process low.
We've had issues of high memory usage with searches encountering patches of large (~10KB or more) _raw fields, so when that happens, we slow down the rate at which we read those events.
That being said, we also discovered that:
- This message is not informative enough
- The default threshold is too low
We are adjusting both of those things in a future release.
In the meantime, if you have enough memory available that you feel comfortable allowing searches to use more of it, you can increase this threshold by changing the value of max_rawsize_perchunk in limits.conf:
max_rawsize_perchunk = <integer>
* Maximum raw size of results per call to search (in dispatch).
* 0 = no limit.
* Defaults to 100000000 (100MB)
* Not affected by chunk_multiplier
