I have some kibana queries which take a very long time (it timeouts) and I struggle to see why, with Elasticsearch/Kibana 6.1.
- My indice is 50Go in 10 hosts
- For testing, I try a query on a very narrow timeframe (2s)
- The query returns 16 results, then I use a GlobalOrdinalsStringTermsAggregator
- The field aggregated are really ip addresses (all valid, I checked them) but the type is "string" in Elasticsearch
So in order to troubleshoot that, I tried to use the profiling API (see the result here)
Which surprises me is the big difference between "took" and the time breakdowns. What could be concerned by "took" except what's in the profiling ?
I read here that it could me network/http related but that does not explain why it's specifically on this aggregation.
Does someone know what could be the issue ?