Keyword Aggregation Table extremely slow compared with equivalent query after 5.6->6.2 upgrade



I recently upgraded from Kibana 5.6.2 to Kibana 6.2 and have found that a table that previously loaded in about 30 seconds for 15 minutes of data dramatically slowed and now loads in almost 3 minutes for the same time range.

However, if I copy the request that Kibana is making to draw this table and run the request in Kibana Devtools or cURL, the request loads in 25 seconds. In other words, Kibana takes an additional 2.5 minutes longer to visualize the data that ES can aggregate in 25 seconds.

In addition, the Safari and Chrome tab used to load the table frequently freezes and stops responding to clicks after the table has loaded.

It is a rather large table with ~27 columns and ~4000 rows (showing 10 per page, but 100 per page had the same issue). 4 of the columns are keyword term aggregations, all sorted by descending term on the same column with size 4000.

My goal with this table is to see a table of performance across the whole system, where each row represents one point in the system uniquely identified by 4 keyword values. I can then sort by each column to see the worst performing rows for each column.

I was able to do this with no problems on 5.6 but can no longer viably use 6.2 for this purpose.

Let me know if you'd like me to run any further experiments or if you need any additional information. Thanks!

Keyword term aggregations much slower after 5.6 -> 6.2 upgrade
(Spencer Alger) #2

Yeah, the table implementation we have isn't very efficient, and if your table is pretty large I can't say I'm surprised that it doesn't work anymore. Unfortunately, in the short term, the only real option you have is to trim down the data you're trying to render.

Of course PRs are always welcome, but rewriting the Kibana table is a massive effort that isn't really at the top of our priority list at the moment. Sorry about that!

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.