How To tune query performance while searching for terms in Kibana

We have single Node cluster. which have logstash, elasticsearch, kibana installed on it.
when we try to search for a terms in the message field and if the messages are huge like(3MB) .

query would be very slow to give the output Documents of the search.

Is there a way to tune the performance of the queries

Hi. Search speed is independent of the size of the document - it’s a term->docid lookup and that speed is the same for big or small docs.

Retrieval and highlighting costs are related to the size of the content though - JSON must be read from disk, parsed and marked up with matches and size is a factor here.
You can test search speeds without retrieval costs if you set “size” to zero in the search request body.

Is There a way to tune the performance??

You can use ‘stored’ fields to make certain fields in the JSON additionally stored as raw separate strings in the Lucene document to avoid retrieving and parsing JSOn.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.