Kibana very slow

(Mats Iremark) #1


So one of the main issues during the Betas was that the Kibana node was limited to 1GB memory and therefore was very slow. Now with the GA of ECE we can choose whatever size we want for Kibana.

Still its super slow. I assume we are doing something wrong on our end. The installation guide has been followed, the machines are under quite easy load etc.

It takes about 10 seconds for the discover window in Kibana to load when there are a few thousand documents to show.

What can I do to find the reason and/or fix this?

Making Kibana faster
(Bohyun Kim) #2

Hi @iremmats

What is the new memory cap for Kibana now?

(Mats Iremark) #3

The instance we are looking at right now we have at 4GB.

(Matt Bargar) #4

Do your documents have a large number of fields? You might be running into this bug:

You could check your browser's dev tools to see if the Elasticsearch query is taking a long time (as would be the case with the bug above).

(Mats Iremark) #5

In the cluster im looking at now we have one index with 300 documents and total of 54 fields. To open the Visualize window in Kibana takes 2.5 seconds according to dev tools.

The other index has 600k documents, takes 25 seconds to open. It has much more fields though.

If I remove the index pattern for the larger index and try to add it again, the screen that tries to load all fields keeps on trying to load forever.

(Mats Iremark) #6

The bigger index has 2500 fields and its doing fine in our 2.3.3 cluster.

(Mats Iremark) #7

If I query Level:* instead of * in Kibana its much quicker.

Kibana 6 - Query/Highlight Performance
(Mats Iremark) #8

Setting doc_table:highlight:all_fields to false in Kibana makes things quick again.
Any good explanation why its still fast in 2.3.3? :slight_smile:

(Matt Bargar) #9

I think there are a couple of things at play here. We made some changes to improve the accuracy of highlighting in 5.3 which may be contributing to the slowdown. But as you noted, a query like <field>:* will be faster than *. This is because of the new all fields mode. I suspect it's the combination of the two that's really hurting us. Both of these issues are on our roadmap to fix.

(system) #10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.