Only search index for results in a selected time range

(Helix) #1


I have been using kibana for several days now and ran into the following problem:

Everything is working perfectly fine as long as I only store data from the last few days. I have to mention that I am collecting a huge amount of data everyday, I am speaking of 40 to 50 GB per day.

Now, after a few days, Kibana started to have Timeouts and the Elasticsearch plugin crashed everytime I tried to open a dashboard, causing a Status Red. I deleted indexes older than 3 days and everything worked again. But about a week later, I stumbled across the same problem - again, I deleted my old indexes and Kibana is running again.

However, this is not a solution since this way, I can't access data older than a few days. Could it be that Kibana always searches all the indexes for results when I refresh a dashboard, and not just the data collected in the selected timerange?

Thank you in advance!

(Christian Dahlqvist) #2

Are you using daily indices? If so, how many indexes and shards do you have per day?

(Helix) #3

One Index per day and only one share.

(Christian Dahlqvist) #4

What is the specification of the cluster with respect to node count, CPU, RAM and type of storage? Which version of Elasticsearch are you using?

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.