Kibana very slow


So one of the main issues during the Betas was that the Kibana node was limited to 1GB memory and therefore was very slow. Now with the GA of ECE we can choose whatever size we want for Kibana.

Still its super slow. I assume we are doing something wrong on our end. The installation guide has been followed, the machines are under quite easy load etc.

It takes about 10 seconds for the discover window in Kibana to load when there are a few thousand documents to show.

What can I do to find the reason and/or fix this?

Hi @iremmats

What is the new memory cap for Kibana now?

The instance we are looking at right now we have at 4GB.

Do your documents have a large number of fields? You might be running into this bug:

You could check your browser's dev tools to see if the Elasticsearch query is taking a long time (as would be the case with the bug above).

In the cluster im looking at now we have one index with 300 documents and total of 54 fields. To open the Visualize window in Kibana takes 2.5 seconds according to dev tools.

The other index has 600k documents, takes 25 seconds to open. It has much more fields though.

If I remove the index pattern for the larger index and try to add it again, the screen that tries to load all fields keeps on trying to load forever.

The bigger index has 2500 fields and its doing fine in our 2.3.3 cluster.

If I query Level:* instead of * in Kibana its much quicker.

Setting doc_table:highlight:all_fields to false in Kibana makes things quick again.
Any good explanation why its still fast in 2.3.3? :slight_smile:

I think there are a couple of things at play here. We made some changes to improve the accuracy of highlighting in 5.3 which may be contributing to the slowdown. But as you noted, a query like <field>:* will be faster than *. This is because of the new all fields mode. I suspect it's the combination of the two that's really hurting us. Both of these issues are on our roadmap to fix.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.