How To tune query performance while searching for terms in Kibana

Elastic Stack Elasticsearch
1

We have single Node cluster. which have logstash, elasticsearch, kibana installed on it.
when we try to search for a terms in the message field and if the messages are huge like(3MB) .

query would be very slow to give the output Documents of the search.

Is there a way to tune the performance of the queries

2

Hi. Search speed is independent of the size of the document - it’s a term->docid lookup and that speed is the same for big or small docs.

Retrieval and highlighting costs are related to the size of the content though - JSON must be read from disk, parsed and marked up with matches and size is a factor here.
You can test search speeds without retrieval costs if you set “size” to zero in the search request body.

3

Is There a way to tune the performance??

4

You can use ‘stored’ fields to make certain fields in the JSON additionally stored as raw separate strings in the Lucene document to avoid retrieving and parsing JSOn.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.