Kibana slow work with x-pack

Hello
I install x-pack and my kibana update dashboard working slow. Earlier data for the last hour loaded in 2 seconds and now it takes at least 15 seconds. I disable monitoring module and etc. I have only security module, but kibana still slows.
It's normal? How can I do kibana more fast working?
P.S. I use default user and roles settings

Hi @111126

I'm not sure why Kibana would slow down significantly only with security on. What happens if you turn xpack.security off as well? Is it still slow then?

I try to next:
x-pack is installed and all modules off. Result: kibana working fast
x-pack is installed and all modules on, but security modules off. Result: kibana working fast

Who have any idea?

Did you install x-pack on both elasticsearch and kibana? What user are you using? If you open up developer tools in your web browser, can you see which request is taking a lot longer?

yes of course

I use default user "elastic"

How I can check it?

Do you use chrome? If so, you can open the tools with https://developers.google.com/web/tools/chrome-devtools/ and then you can see how to measure resource loading times https://developers.google.com/web/tools/chrome-devtools/network-performance/resource-loading

If you can see a difference between specific requests both with and without security that will help us try to figure it out

The next request is taking a lot longer:

Can you share what it looks like without security for comparison?

I set xpack.security.enabled: false in elasticsearch.yml and kibana.yml, then restart elastic and kibana. After that, I check:

Thank you. It looks like field stats requests are a lot slower with security; the msearch time looks ok. Can you confirm the exact version you have?

I use ELK and X-pack version 5.0.2.

Sorry for all of the questions. Have you defined any roles that use field or document level security?

Edit: also can you share stats for those indices and your cluster? Specifically the number of segments would be useful. Also is there any xpack configuration on the elasticsearch side that was changed from default (anonymous, realms, etc)?

No. I Use default users, roles and other x-pack settings

Yes. If you tell me how I can check it?

Yes. If you tell me how I can check it?

Sure, the output of the following APIs will be helpful (console syntax):

GET _segments?verbose=true
GET _cat/indices?v
GET _xpack/security/user
GET _xpack/security/role
GET _nodes

Thank you for working with me on this so we can get to the bottom of what is going on here.

OK. But is private info. How can I forward those info only for you?

I sent you a private message and you can send me the details there.

My GET _segments?verbose=true output is 276Mb. It`s normal?

Try to leave the ?verbose off. It should be smaller but I'm not sure by how much

I sent you private message