# Ask help for optimizing ES search performance

**URL:** <https://discuss.elastic.co/t/ask-help-for-optimizing-es-search-performance/49696>\
**Category:** Elasticsearch\
**Created:** [May 10, 2016, 5:57pm UTC](https://discuss.elastic.co/t/ask-help-for-optimizing-es-search-performance/49696 "2016-05-10T17:57:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![WuZixing](https://avatars.discourse-cdn.com/v4/letter/w/41988e/32.png) [@WuZixing](https://discuss.elastic.co/u/WuZixing)\
**Post date:** [May 10, 2016, 5:57pm UTC](https://discuss.elastic.co/t/ask-help-for-optimizing-es-search-performance/49696/1 "2016-05-10T17:57:43Z")

</div>

Hi, guys,

I am employing ES to do log message query. I got about 100G sized indices which are mainly distributed in 14 indices. A search test was imposed to search log messages from one of the 14 indices. And the test said ES took ~5s-20s to finish one query.

###Here is the index template I have imposed on the index:

```auto
"service_log_template" : {
    "order" : 0,
    "template" : "service_log_*",
    "settings" : {
      "index" : {
        "number_of_replicas" : "0",
        "number_of_shards" : "10"
      }
    },
    "mappings" : {
      "log" : {
        "properties" : {
          "Instance" : {
            "index" : "not_analyzed",
            "type" : "string"
          },
          "Host" : {
            "index" : "not_analyzed",
            "type" : "string"
          },
          "Level" : {
            "index" : "not_analyzed",
            "type" : "string"
          },
          "Content" : {
            "type" : "string"
          },
          "Timestamp" : {
            "index" : "not_analyzed",
            "type" : "long"
          }
        }
      }
    },
    "aliases" : { }
  }

```

###And here is what the query request like:

```auto
"query":
{
  "bool":
  {
    "filter":
    [
      {"term":{"Level":"INFO"}},
      {"term":{"Instance":"AAAABBBBCCCCDDDD"}},
      {
        "match":
        {
          "Content":
          {
            "query":"pinyin",
            "type":"boolean"
          }
        }
      },
      {
        "range":
        {
          "Timestamp":{"from":1462842567465499517,"include_lower":true,"include_upper":true,"to":null}
        }
      }
    ]
  }
},
"size":20,
"sort":[{"Timestamp":{"order":"asc"}}]

```

###And for my ES node configuration  
It is a single node running exclusively on the box.  
CPU: 4  
RAM: 14G  
RAM for ES JVM: 6G

Thanks for any suggestion on what I should do to optimize the query performance.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 11, 2016, 11:41pm UTC](https://discuss.elastic.co/t/ask-help-for-optimizing-es-search-performance/49696/2 "2016-05-11T23:41:05Z")

</div>

What version of ES are you on?

---

<div class="post-metadata">

**Author:** ![WuZixing](https://avatars.discourse-cdn.com/v4/letter/w/41988e/32.png) [@WuZixing](https://discuss.elastic.co/u/WuZixing)\
**Post date:** [May 12, 2016, 3:51am UTC](https://discuss.elastic.co/t/ask-help-for-optimizing-es-search-performance/49696/3 "2016-05-12T03:51:52Z")

</div>

It's ES v2.3.1.  
All the log messages are with same "Level", "Instance", and "Content", but with different "Timestamp", since I was running a test for the production environment. "Content" field holds about 100 characters which contains alphanumeric characters and Chinese characters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:52pm UTC](https://discuss.elastic.co/t/ask-help-for-optimizing-es-search-performance/49696/4 "2017-07-05T22:52:15Z")

</div>