Kibana Dashboard loading Issue

[rohitguptaggg]

Hello,

I have created a Kibana dashboard using a filter and query, but it is causing loading issues and the Elasticsearch CPU is going up to 99%, even though there are 3 Elasticsearch nodes. Can someone please help and suggest how to handle this type of query for the dashboard and provide some query optimization techniques to solve this issue? also please help with teh some suggestion for the best practices so that i can improve my dashboards to load fatser .

The query used for the dashboard is given below.

{
  "query": {
    "bool": {
      "must_not": [
        {
          "wildcard": {
            "payload.data.details.keyword": "[j-*]*onConnectionFailure*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "_reconnectDevices: onError Exception: maximum number of retries reached*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "*Sanity check: Finished log uploading unsuccessfully*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "*upload logs InternetConnectionException Instance of 'InternetConnectionException*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "*set slow params error:PlatformException(i not ready*is not initialized or has been disposed, {details: *, message: Device not reachable*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "*[j-*] Bluetooth stack returned GATT error status 133*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "*HAT download error caused by com.medtronic.minimed.connect.ble*GATT service is not provided by the server*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "*HAT download error *Exception occurred in transfer block parsing*"
          }
        },
        {
          "wildcard": {
            "payload.data.details.keyword": "*HAT download error caused by *Actual payload length*doesn't match the expected (567)*"
          }
        }
      ]
    }
  }
}

Thank you.

[carly.richmond]

Hi @rohitguptaggg,

I would recommend running the query using the Search Profiler or Profile API if you can to see the bottlenecks.

Looking at your query and checking the warning in the wildcard documentation the clauses starting with * characters will be expensive:

Avoid beginning patterns with * or ? . This can increase the iterations needed to find matching terms and slow search performance.

I would recommend removing the preceding * from terms if you can.