Issue with queries using highlighting and fields * - hundreds of times slower

I am having the exact same issue on 6.3.2 and only by disabling highlighting can i make queries work properly. My mapping is about 150 lines. Can provide other details as needed.

GET /filebeat-6.3.2-box201-box_logs-*/_search
"size":1500,"query": {
    "bool": {
      "must": [
          "range": {
            "@timestamp": {
              "gte": 1533821817189,
              "lte": 1533822717189,
              "format": "epoch_millis"
      "filter": [
          "match_all": {}
      "should": [],
      "must_not": []

without highlight (which was autogenerated in discover) it took 49, with it takes 9711.

What could be the issue?

How large are your documents? Looks like highlighting with large documents can be slow.

Are you looking for a way to turn highlighting off? You can do this by navigating to Management => Advanced Settings and then unselect doc_table:highlight.

One line logs, small. I have already disabled highlighting as response times are then fine - but i would like to have highlighting enabled.

Seeing the post i included, this seems to be a long time thing right?

I would be happy to supply any and all further details, mappings, settings etc.
Any ideas out there?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.