A poorly configured Elasticsearch fielddata cache is often the reason for OutOfMemoryError exceptions.
When running a sort or aggregation (or facet) query, Elasticsearch fills the cache with all distinct field values from the query. This allows similar, subsequent queries to execute more quickly. However, Elasticsearch doesn't put an upper bound on the cache size by default; therefore, the data is not automatically evicted. If the cache causes the total JVM memory to fill up beyond the ES_HEAP size, the node will throw an OutOfMemoryError exception and will require an Elasticsearch restart.
To limit the fielddata cache size, set the indices.fielddata.cache.size value:
indices.fielddata.cache.size: 30%
This will limit the fielddata cache size to 30% of the available JVM heap space.
You can set this value to a fixed value as well. For example, setting it to 10gb will limit the cache size to no more than 10 gigabytes. The value that you choose will depend on the cluster and use...
