'Discover' endlessly searching on Index


(Russell Morris) #1

In my initial ignorance and enthusiasm, I installed nxlog on a load of servers and started pumping Windows events into my Elasticsearch/Kibana/Fluentd box. I wasn't aware quite how many different fields would build up, and I had an index with about 600 fields before long; needless to say, the box ground to a halt.

I deleted the data, and placed nxlog on just a couple of domain controllers - now I have 11 fields, and life looks much better. Unfortunately when I go to 'Discover' and select the index pattern from the drop-down list, it sits there "searching" endlessly. I had previously deleted and recreated that index.

I would appreciate any recommendations on where to start debugging this, as I'm still a bit green with Kibana.


(Jaminvp) #2

What's the discover sample size in Kibana? (Settings -> Advanced -> discover: sample size).


(Russell Morris) #3

Hi jaminvp, and thank you for your reply.

discover:sampleSize is set to 500, and the discover view seem work when viewing the only other index.


(system) #4