I'm creating a visualization in Kibana and want to filter a
url.keyword field so that only a subset of about 50 urls are included in the search. In addition, I want to filter everything on a second field
I curently have a query attached to the visualization that looks something like this:
(url.keyword:"http://a.com" OR ... OR url.keyword:"http://z.com") AND field2.keyword:true
This seems to take a long time to execute (although it was much faster on 2.3 with
.raw fields) and when I put several of these visualizations together on a dashboard it even causes the JVM heap to overflow and crashes ES. Is there a more efficient way to write this query? I feel like I should be using the json input option instead but I'm not sure it actually queries any differently on the backend.
I appreciate the assistance.