Histogram is slow

Elastic Stack Elasticsearch
1

Hi, we are having ELK 5.4.3 and 6.1.1 and in both cases thin one chart - histogram is really slow. Other charts are fine. Any idea why?

I've set "_all" field so "query:*" will search only in one field.
And in Profiler query takes 2,8 ms that's fine nad expands only into boolean query, ConstantScoreQuery -> termquery and IndexOrDocValuesQuery.
I think the problem will be in Kibana. I don't use any scripted field.

{
  "size": 0,
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "histogram": {
        "field": "attrs.rtp-MOScqex-avg",
        "interval": 1,
        "min_doc_count": 1
      },
      "aggs": {
        "1": {
          "avg": {
            "field": "attrs.rtp-MOScqex-avg"
          }
        }
      }
    }
  },
  "version": true,
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "query_string": {
            "analyze_wildcard": true,
            "fuzziness": 0,
            "query": "*",
            "fuzzy_max_expansions": 0
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1538473194625,
              "lte": 1538494794625,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "must_not": []
    }
  }
}
2

Hi @Akaren,

First of all, wouldn't it be sufficient to run just the range query? match_all and the wildcard query_string seem to match all documents anyway. So this seems redundant.

Other than that, how do you quantify that the histogram is slow, if the profiler takes only 2.8ms to execute?

3

This is the way how is it generated by Kibana. Of course I can change it in Saved object.

Because my dashboard has around 10 charts and when I set timerange to 1 day (around 30 GB data), the dashboard is loading, part of chart is vizualized and the browser will show popup window "window is not responding" and get stuck. Chrome and Mozilla, different PC. But when I delete this chart, loading whole dashboard is without problem. I've tried to delete also other charts but only this one made it work.

4

Interesting, next to it, there is the same chart with same data just date_histogram (not only histogram) and this one is not blocking page loading.

5

No ideas what should I check?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.