Performance drop when script_fields encode in Elasticsearch request body

[Mike_Hung]

Last week I upgraded to Elastic Stack 6.1. I had some performance issue for visualization.
When I looking to the Elasticsearch request body, I found the script_fields (named in 0, 1, 2, 3) encoded in the request body as following:

{
  "size": 0,
  "_source": {
    "excludes": []
  },
  "aggs": {},
  "stored_fields": [
    "*"
  ],
  "script_fields": {
    "0": {
      "script": {
        "inline": "return 0;",
        "lang": "painless"
      }
    },
    "1": {
      "script": {
        "inline": "return 1;",
        "lang": "painless"
      }
    },
    "2": {
      "script": {
        "inline": "return 2;",
        "lang": "painless"
      }
    },
    "3": {
      "script": {
        "inline": "return 3;",
        "lang": "painless"
      }
    }
  },
  "docvalue_fields": [
    "@timestamp"
  ],
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1500100277053,
              "lte": 1515997877053,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "filter": [],
      "should": [],
      "must_not": []
    }
  }
}

But Kibana 5.6 didn't encode the script_fields in the request body.

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1514736000000,
              "lte": 1517414399999,
              "format": "epoch_millis"
            }
          }
        }
      ],
      "must_not": []
    }
  },
  "_source": {
    "excludes": []
  },
  "aggs": {}
}

I think all of the script_fields in request body will slow down the search speed.
How can I fix it?

[timroes]

Hey Mike,

scripted fields can be configured in your index pattern settings in Kibana management.

Could you go to Management > Index Patterns > <select the index pattern you are using on the left side> >Scripted fields (tab over the table).

You can configure (and remove) scripted fields in that table.

Cheers,
Tim

[Mike_Hung]

Hello Tim,

Thanks for your reply.

In fact I really need to use all of the script fields.
Can I configure the scripted fields not to encoded into every elasticsearch request body?

In Kibana 6.1, I need to take 3 second for basic count metrics due to the request body contains all script fields.
But it tooks only 50 millisecond when I remove all script fields (just like Kibana 5.6).

[timroes]

Hi Mike,

a possible solution could be to create two index settings, that point to the same indexes. In that case you could give one of the index patterns the scripted fields and one not, and you only use the index pattern with scripted fields, where you really need it.

Cheers,
Tim

[Mike_Hung]

Hi Tim,

Thank you Tim. It works!
But it's not a convenient way due to we have lots of script fields.

This behavior (encoded all script fields into every query) is a bug or by design?
And it will be changed in the further version?

[timroes]

Right now this is feature. But please feel free to open an feature request on GitHub and describe what behavior you would wish for.

Cheers,
Tim