# Query response times

**URL:** <https://discuss.elastic.co/t/query-response-times/10461>\
**Category:** Elasticsearch\
**Created:** [January 22, 2013, 9:51pm UTC](https://discuss.elastic.co/t/query-response-times/10461 "2013-01-22T21:51:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shift](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@shift](https://discuss.elastic.co/u/shift)\
**Post date:** [January 22, 2013, 9:51pm UTC](https://discuss.elastic.co/t/query-response-times/10461/1 "2013-01-22T21:51:57Z")

</div>

I am indexing about 520GB of log files to elasticsearch a day. At this phase I am only keeping 24 hours of data (eventually the goal is 7 days).

Searches can be very slow, especially when I need to search a large field like @message. It can take up to 45 seconds. The time improves if I do not need to use asterisks, it'll reduce from 45 seconds to 9 seconds. If I select which index to search, it'll reduce to 0.51 seconds (no asterisks), or 12.9 seconds (with asterisks) -- times vary. Unfortunately, some users will search for generic strings that require us to append asterisks to find results.

What can I do to improve these queries? I need to address the need for using asterisks and route the user to the appropriate index. Should I try index routing? Are there any good example templates?

Here is an example @message:  
A|aBCdef|Jan 22 08:32:26 2013|log.sample.app.call.SampleSvr|12345|node| 123456|bar |CodeName.cpp|123|\*\*\*\*\* START OF A LONG MESSAGE \*\*\*\*\*|12345.0123

Here is an example query:

{  
"query": {  
"bool": {  
"must": [  
{  
"query\_string": {  
"default\_field": "@message",  
"query": "_SampleSvr_"  
}  
}  
],  
"must\_not": [],  
"should": []  
}  
},  
"from": 0,  
"size": 50,  
"sort": [],  
"facets": { }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:55am UTC](https://discuss.elastic.co/t/query-response-times/10461/2 "2017-07-06T02:55:07Z")

</div>