After query, Kibana unresponsive

Elastic Stack Kibana
1

Hi,

I have ELK stack with one node (master). I will pipe logs from about 10 servers, about 500.000 logs in 12 hours.

Hardware:
VPS (6 CPU)
Memory: 15GB
Heap size: 8GB
Swappoff

I have problem when I try to search some query in Kibana.
e.g. I first choose Absolutly date, about 2 days. I see about 1.500.000 hits (logs).
Match filter only one input type. I see about 700 hits (logs)
When I input query one word, e.g backup or "backup complete" or something else, Kibana goes to unresponsive mode. I must to Kill browser.

Disk I/O is small, CPU utilization small, Memory free 12GB.
Please help me. Thank you.

2

Hi Petar,

What versions of Elasticsearch and Kibana are you running? And what OS are you on?

Can you check Kibana and Elasticsearch logs to see if there's any clues there?

When you say "Kibana goes to unresponsive mode" do you mean you get the message like "a script is not responding do you want to wait or close" (might be different on different browsers)?

In your browser, you could hit F12 and start the Network tool. Then if you try your query again you should see what the request is that Kibana made to Elasticsearch. That might help us figure out what the problem is.

Thanks,
Lee

3

Dear,

Elastic version:

{
"name" : "Dougboy",
"cluster_name" : "elasticsearch",
"version" : {
"number" : "2.2.1",
"build_hash" : "d045fc29d1932bce18b2e65ab8b297fbf6cd41a1",
"build_timestamp" : "2016-03-09T09:38:54Z",
"build_snapshot" : false,
"lucene_version" : "5.4.1"
},
"tagline" : "You Know, for Search"
}

Kibana version: 4.4.2

I can`t open Inspect (F12) Network tool, because whole Tab in Chrome is not responsive. After a couple seconds I can click on Wait or Kill.

In Logstash and Kibana logs I haven't error or warning.

OS is Linux Ubuntu 14.04 LTS.

4

Hi Petar,

Start the browser (F12) Network tool before you do your query for "backup".

Thanks,
Lee

5

Hi Lee,

I found what is problem. I use IMAP plugin for mail. I receive some report email from some backup with text attachment that has about 15 pages text. When I want to search something in that index Kibana stop responding.

Does it have some way to exclude attachment in received mail with IMAP plugin filter ?

Thank you Lee.

6

Hi Petar,

I'm glad you found the problem.
I've never heard of the IMAP plugin filter. Is it a Logstash thing? You might have to search and/or ask a question on that Discuss page. https://discuss.elastic.co/c/logstash

Thanks,
Lee

7

Yes, Logstash.
Ok thank you very much.

I will post my problme with IMAP plugin in Logstash discuss.