Performance of a Saved Search 'table view' in Dashboard severely worse than Discover

Elastic Stack Kibana
1

Forgive me if I missed something online or in the documentation, but I can't seem to figure out why a saved search would perform so differently in the 'Disocver' tab as opposed to the 'Dashboard' tab.

In the Dev Tools debugger, I was seeing <= 20 ms response times for a relatively simple query:
{"bool":{"filter":{"term":{"hostname":"xxxx"}}}}

This same query in the 'Discover' view for 'Week to day' takes around 600 ms. This in it of itself perplexed me a bit, but it seems to be API overhead (correct me if I'm wrong please :slight_smile: ).

A dashboard with only one visualization, this same saved search, and the exact same time range, yields a far worse result. Averaging 4600 ms.

2

I'm not sure why the response time would be different. The _msearch API is used in both places.

Is there possibly different sorting of fields in the different areas? That could have to do with the difference.

You can look at the raw request for the searches using the Spy panel, and then send the queries to ES to see if ES is handling it differently.

3

I noticed it was the same _msearch API which is what confused me the most.

Thanks for pushing me to look at the request body! (although I could not find this 'Spy panel' in Kibana 5, I used chrome dev tools)

Anyways, my issue is resolved. It appears the dashboard view was injecting a query_string body that really bogged down the response time. By changing "highlightAll": true to "highlightAll: false in the saved search object it now matches the speed of the Discover view.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.