# Kibana search for last 24h wait for warm nodes **URL:** \ **Category:** Elasticsearch\ **Created:** [January 18, 2017, 9:59am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968 "2017-01-18T09:59:34Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mkostrikin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkostrikin/32/14667_2.png) [@mkostrikin](https://discuss.elastic.co/u/mkostrikin)\ **Post date:** [January 18, 2017, 9:59am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/1 "2017-01-18T09:59:34Z")
Hello, We have a ELK stack with hot/warm ES nodes, 3 node for hot and 3 node for warm. We keep 7 days in hot, older moved to warm. We expect searches for last 24 hour will load only hot ES nodes, but kibana keep waiting for reply ( we guess ) from warm ES nodes. Load of ES nodes are monitored and one of the warm node is 100% CPU busy, during test searches. ES 2.2.2 version, Kibana 4.4.0 Searching for similar issues gives nothing. Please advise. Thanks, ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 18, 2017, 10:06am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/2 "2017-01-18T10:06:11Z")
How have you specified your index patterns in Kibana? ---
**Author:** ![mkostrikin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkostrikin/32/14667_2.png) [@mkostrikin](https://discuss.elastic.co/u/mkostrikin)\ **Post date:** [January 18, 2017, 11:42am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/3 "2017-01-18T11:42:03Z")
Settings for index patterns are: Index contains time-based events - CHECKED Use event times to create index names - UNCHECKED logstash-\* Do not expand index pattern when searching - UNCHECKED Time-field name "@timestamp" ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 18, 2017, 11:56am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/4 "2017-01-18T11:56:31Z")
I am not sure if Kibana 4.4 was able to limit the amount of indices queried based on the field stats API. so by using a wildcard pattern it is possible that you are hitting all shards. For earlier versions of Kibana, before the field stats API was available, it was generally beneficial to configure the date pattern in the Kibana index pattern. ---
**Author:** ![mkostrikin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkostrikin/32/14667_2.png) [@mkostrikin](https://discuss.elastic.co/u/mkostrikin)\ **Post date:** [January 19, 2017, 5:08am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/5 "2017-01-19T05:08:17Z")
I have tried logstash-\* , with and without `Do not expand index pattern when searching` [logstash-]YYYY.MM.DD All are loading warm nodes by search on last 24h. I am going to try same searches on 2.4 or 5.1 ES cluster. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 19, 2017, 5:52am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/6 "2017-01-19T05:52:35Z")
You will need to enable `Use event times to create index names` and leave `Do not expand index pattern when searching` disabled. You can use Chrome developer tools (or similar functionality in other browsers) to inspect the request and verify that it is rewritten to only target a subset of the available indices. ---
**Author:** ![mkostrikin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkostrikin/32/14667_2.png) [@mkostrikin](https://discuss.elastic.co/u/mkostrikin)\ **Post date:** [January 19, 2017, 6:30am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/7 "2017-01-19T06:30:18Z")
```auto {"index":["logstash-*"],"ignore_unavailable":true} {"size":500,"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],"query":{"filtered":{"query":{"query_string":{"analyze_wildcard":true,"query":"*"}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"gte":1484719730791,"lte":1484806130791,"format":"epoch_millis"}}}],"must_not":[]}}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"require_field_match":false,"fragment_size":2147483647},"aggs":{"2":{"date_histogram":{"field":"@timestamp","interval":"30m","time_zone":"UTC","min_doc_count":0,"extended_bounds":{"min":1484719730786,"max":1484806130786}}}},"fields":["*","_source"],"script_fields":{},"fielddata_fields":["@timestamp","timestamp8601"]} ``` This is payload for search last 24h. It does not select any indeces. I guess, kibana selects indeces for search. As I mentioned before, [logstash-]YYYY.MM.DD with enabled `Use event times to create index names` and disabled `Do not expand index pattern when searching`. Last one hidden with `Use event...` - gives the same problems. warm nodes are got loaded. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 16, 2017, 6:30am UTC](https://discuss.elastic.co/t/kibana-search-for-last-24h-wait-for-warm-nodes/71968/8 "2017-02-16T06:30:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.