Message "Your query is taking a while"

Hi people, I've implemented the netflow module with Filebeat. In my ELK 7.8.0 I'm receiving a lots of flows from a BGP router, and when I go to the Filebeat Netflow dashboards and I query for a long date range (24 hs and more), the query is too slow and I get this message:

"Your query is taking awhile"

No data and geolocalization are displayed.

And after that I see this error:

RequestTimeoutError: Request timed out
at e._subscribe (
at e._trySubscribe (
at e.subscribe (
at (
at e.subscribe (
at new Promise ()
at e.toPromise (
at SearchSource._callee2$ (
If the query is for 1 hour, 6 hours, 10 hours, it works OK and I can retrieve all the flow data and their geolocalization.

I have 10 CPU's, 20 GB RAM, and -Xms10g m / -Xmx10g for java heapspace.

I send all netflow data to the same filebeat index as the other incoming events. from remote machines with Filebeat installed.

Can you help me please ?

Special thanks !

What is the size of you indices and shards? What type of storage do you have? What is the indexing rate?

Dear Christian, thanks for your response.

Please can you tell me how I should calculate the size of my indices and shards, and the indexing rate?

My storage is not a SSD disk yet, because it's a test scenario.

If I put all netflow events in the same index of the filebeat events from remote machines, can this be a problem ?

Because when I put all network events in a separate index called "netflow-xxxx", the geolocalization doesn't work because it wait for filebeat data matching.

Thanks again, cheers !

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.