# Intermittent slowness in queries
**URL:** https://discuss.elastic.co/t/intermittent-slowness-in-queries/255087
**Category:** Elasticsearch
**Tags:** docker
**Created:** [November 11, 2020, 2:37pm UTC](https://discuss.elastic.co/t/intermittent-slowness-in-queries/255087 "2020-11-11T14:37:25Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@dcamozzato](https://discuss.elastic.co/u/dcamozzato)
#### Post date: [November 11, 2020, 2:37pm UTC](https://discuss.elastic.co/t/intermittent-slowness-in-queries/255087/1 "2020-11-11T14:37:25Z")
Hi,
I am trying to understand some intermittent slowness in my stack. The symptom is this: I go into Kibana and run a query filtering only by time - "last 24 hours", for example - and I get results in 2 seconds. Ten minutes later I try the same query, but the query runs beyond the timeout, taking around 90 seconds to respond.
Looking at the stack management graphs in Kibana, I see no spikes at the time when this happened (except for the "Search Latency" graph, which I suppose is the aforementioned problem, in itself). As far as I can tell, the Elasticsearch nodes seem to have plenty of free resources (CPU, JVM heap, disk, etc.).
The query time _seems_ to be proportional to the number of results. To check this, I have made different queries and plotted "number of results" vs. "response time", which gave me a line. For example, using a query that gives me 1/2 the results gives me a response time that is also roughly 1/2.
I further tested using different sample sizes (the number of results actually returned to Kibana), and it didn't seem to significantly impact the results. I also tested with/without a scripted field I use, and had similar results. In other words, these do not seem to be the issue.
Some more information about the stack setup:
1. The Elasticsearch nodes are running in docker containers in separate hosts. Each node has 16 GB of JVM heap, and utilization stays around 60% on all nodes. The Elasticsearch data folder is bind-mounted to the host. The cluster is working in "production" mode.
2. Logstash is being used to collect syslog from multiple different network devices. The syslog runs through a series of Grok filters to parse different formats of syslog message. Then, the parsed fields are pushed into a "syslog-\*" index in Elasticsearch. There are no other steps beyond that (in other words, I did not explicitly set up anything in Elasticsearch).
Any suggestions or assistance you can provide to understand this problem would be greatly appreciated.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 9, 2020, 2:37pm UTC](https://discuss.elastic.co/t/intermittent-slowness-in-queries/255087/2 "2020-12-09T14:37:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.