# Kibana slow work with x-pack

**URL:** <https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372>\
**Category:** Kibana\
**Created:** [November 28, 2016, 3:32pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372 "2016-11-28T15:32:17Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [November 28, 2016, 3:32pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/1 "2016-11-28T15:32:17Z")

</div>

Hello  
I install x-pack and my kibana update dashboard working slow. Earlier data for the last hour loaded in 2 seconds and now it takes at least 15 seconds. I disable monitoring module and etc. I have only security module, but kibana still slows.  
It's normal? How can I do kibana more fast working?  
P.S. I use default user and roles settings

---

<div class="post-metadata">

**Author:** ![thomasneirynck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thomasneirynck/32/23313_2.png) [@thomasneirynck](https://discuss.elastic.co/u/thomasneirynck)\
**Post date:** [November 28, 2016, 11:42pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/2 "2016-11-28T23:42:27Z")

</div>

Hi @111126

I'm not sure why Kibana would slow down significantly only with security on. What happens if you turn xpack.security off as well? Is it still slow then?

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [November 29, 2016, 7:15am UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/3 "2016-11-29T07:15:48Z")

</div>

I try to next:  
x-pack is installed and all modules off. Result: kibana working fast  
x-pack is installed and all modules on, but security modules off. Result: kibana working fast

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 2, 2016, 7:31am UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/4 "2016-12-02T07:31:35Z")

</div>

Who have any idea?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 5, 2016, 12:18pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/5 "2016-12-05T12:18:40Z")

</div>

Did you install x-pack on both elasticsearch and kibana? What user are you using? If you open up developer tools in your web browser, can you see which request is taking a lot longer?

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 5, 2016, 1:47pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/6 "2016-12-05T13:47:38Z")

</div>

> [@jaymode](#):
>
> Did you install x-pack on both elasticsearch and kibana?

yes of course

> [@jaymode](#):
>
> What user are you using?

I use default user "elastic"

> [@jaymode](#):
>
> If you open up developer tools in your web browser, can you see which request is taking a lot longer?

How I can check it?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 5, 2016, 2:05pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/7 "2016-12-05T14:05:31Z")

</div>

Do you use chrome? If so, you can open the tools with [https://developers.google.com/web/tools/chrome-devtools/](https://developers.google.com/web/tools/chrome-devtools/) and then you can see how to measure resource loading times [https://developers.google.com/web/tools/chrome-devtools/network-performance/resource-loading](https://developers.google.com/web/tools/chrome-devtools/network-performance/resource-loading)

If you can see a difference between specific requests both with and without security that will help us try to figure it out

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 5, 2016, 2:24pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/8 "2016-12-05T14:24:32Z")

</div>

The next request is taking a lot longer:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/7/7c3814d64b87fcefcdf376b2e216d1cd43ca8893.JPG)

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 5, 2016, 2:33pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/9 "2016-12-05T14:33:22Z")

</div>

Can you share what it looks like without security for comparison?

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 5, 2016, 2:50pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/10 "2016-12-05T14:50:14Z")

</div>

I set `xpack.security.enabled: false` in elasticsearch.yml and kibana.yml, then restart elastic and kibana. After that, I check:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e05dd06ee007cfd55680ef6a1fbf79405dc66ec9.JPG)

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 5, 2016, 3:42pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/11 "2016-12-05T15:42:02Z")

</div>

Thank you. It looks like field stats requests are a lot slower with security; the msearch time looks ok. Can you confirm the exact version you have?

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 5, 2016, 4:07pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/12 "2016-12-05T16:07:42Z")

</div>

I use ELK and X-pack version 5.0.2.

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 5, 2016, 4:31pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/13 "2016-12-05T16:31:08Z")

</div>

Sorry for all of the questions. Have you defined any roles that use field or document level security?

Edit: also can you share stats for those indices and your cluster? Specifically the number of segments would be useful. Also is there any xpack configuration on the elasticsearch side that was changed from default (anonymous, realms, etc)?

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 6, 2016, 11:18am UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/14 "2016-12-06T11:18:07Z")

</div>

> [@jaymode](#):
>
> Have you defined any roles that use field or document level security?  
> Also is there any xpack configuration on the elasticsearch side that was changed from default (anonymous, realms, etc)?

No. I Use default users, roles and other x-pack settings

> [@jaymode](#):
>
> Edit: also can you share stats for those indices and your cluster? Specifically the number of segments would be useful.

Yes. If you tell me how I can check it?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 6, 2016, 11:42am UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/15 "2016-12-06T11:42:43Z")

</div>

> Yes. If you tell me how I can check it?

Sure, the output of the following APIs will be helpful (console syntax):

GET \_segments?verbose=true  
GET \_cat/indices?v  
GET \_xpack/security/user  
GET \_xpack/security/role  
GET \_nodes

Thank you for working with me on this so we can get to the bottom of what is going on here.

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 6, 2016, 3:23pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/16 "2016-12-06T15:23:50Z")

</div>

OK. But is private info. How can I forward those info only for you?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 6, 2016, 3:56pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/17 "2016-12-06T15:56:14Z")

</div>

I sent you a private message and you can send me the details there.

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 6, 2016, 4:30pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/18 "2016-12-06T16:30:15Z")

</div>

My GET \_segments?verbose=true output is 276Mb. It`s normal?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [December 6, 2016, 4:40pm UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/19 "2016-12-06T16:40:39Z")

</div>

Try to leave the `?verbose` off. It should be smaller but I'm not sure by how much

---

<div class="post-metadata">

**Author:** ![111126](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111126/32/36818_2.png) [@111126](https://discuss.elastic.co/u/111126)\
**Post date:** [December 7, 2016, 8:12am UTC](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372/20 "2016-12-07T08:12:54Z")

</div>

I sent you private message

[Next page](https://discuss.elastic.co/t/kibana-slow-work-with-x-pack/67372.md?page=2)
