# OpenDistro Alert Error- 1.7.0 - field expansion matches too many fields

**URL:** <https://forum.opensearch.org/t/opendistro-alert-error-1-7-0-field-expansion-matches-too-many-fields/2975>\
**Category:** Alerting\
**Created:** [June 3, 2020, 6:36pm UTC](https://forum.opensearch.org/t/opendistro-alert-error-1-7-0-field-expansion-matches-too-many-fields/2975 "2020-06-03T18:36:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![karmine](https://avatars.discourse-cdn.com/v4/letter/k/77aa72/32.png) [@karmine](https://forum.opensearch.org/u/karmine)\
**Post date:** [June 3, 2020, 6:36pm UTC](https://forum.opensearch.org/t/opendistro-alert-error-1-7-0-field-expansion-matches-too-many-fields/2975/1 "2020-06-03T18:36:08Z")

</div>

Hi Team,

I am trying to use Open Distro’s alerting and getting the following error:

> “caused\_by”: {  
> “reason”: “field expansion matches too many fields, limit: 1024, got: 1220”,  
> “type”: “illegal\_argument\_exception”  
> },

after doing some researching ( ref - [Elasticsearch - set max\_clause\_count - Stack Overflow](https://stackoverflow.com/questions/40275514/elasticsearch-set-max-clause-count)) added the search settings **indices.query.bool.max\_clause\_count** to the elasticsearch.yml config. This caused the elasticsearch.service to not start and timeout.

I am looking to get a solution that will allow me to create Alerts with out getting the above mentioned error from Open Distro.

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [February 7, 2023, 5:17pm UTC](https://forum.opensearch.org/t/opendistro-alert-error-1-7-0-field-expansion-matches-too-many-fields/2975/2 "2023-02-07T17:17:50Z")

</div>