Issue with queries using highlighting and fields * - hundreds of times slower

Elastic Stack Kibana
1

I am having the exact same issue on 6.3.2 and only by disabling highlighting can i make queries work properly. My mapping is about 150 lines. Can provide other details as needed.

GET /filebeat-6.3.2-box201-box_logs-*/_search
{
"size":1500,"query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": 1533821817189,
              "lte": 1533822717189,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [
        {
          "match_all": {}
        }
      ],
      "should": [],
      "must_not": []
    }
  },
  "highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fragment_size":2147483647,"fields":{"*":{}}}
}

without highlight (which was autogenerated in discover) it took 49, with it takes 9711.

What could be the issue?

2

How large are your documents? Looks like highlighting with large documents can be slow.

Are you looking for a way to turn highlighting off? You can do this by navigating to Management => Advanced Settings and then unselect doc_table:highlight.

3

One line logs, small. I have already disabled highlighting as response times are then fine - but i would like to have highlighting enabled.

Seeing the post i included, this seems to be a long time thing right?

4

I would be happy to supply any and all further details, mappings, settings etc.
Any ideas out there?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.