Analyzed string can use a lot of memory to visualize

Elastic Stack Kibana
1

Hi im using rsyslog+ES+kibana
es on 3 servers cluster
after 10 days my kibana work but its very slow

Untitled.png745×674 19.7 KB
Untitled2.png1571×667 20.7 KB

i think that the analyzed fileds use lot of memory .. there is any solution
i used ES to index logs from Rsyslog 2000 network equipment
thank you

2

Turn them into not analysed and use doc values.

The problem isn't that KB is slow, it'll be that ES is slowing down due to the amount of data you have and are querying. You should be monitoring it to see what is happening.

1 Like
3

thank you
"mappings": {
"default": {
"_all": {
"enabled": false
},
"properties": {

 "@timestamp": {
                "type": "date",
                "index": "not_analyzed",
                "doc_values": true
            },
            "host": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "severity": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "facility": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "syslogtag": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "message": {
                "type": "string",
                "index": "analyzed"

            }

like that ?

4

Yep :smiley:

1 Like