Failed execution of ESQL query and high cpu load

Elastic Security
6

  1. In /app/management/kibana/dataViews, find the one with tag Security Data View, click on it. Select Edit, remove logs-*, from both Name field and Index pattern field

  2. Visit /app/security/timelines , create a new timeline or update an existing timeline, click ES|QL tab, remove logs-* from the query and click Update.

  3. Whenever you use ESQL query, try not to include logs-* in the query and observe if the performance improved.

If you'd like to know more about Data view: Create a Data view | Kibana Guide [8.11] | Elastic