# Query slowness issue in ES 1.7.1

**URL:** https://discuss.elastic.co/t/query-slowness-issue-in-es-1-7-1/44119
**Category:** Elasticsearch
**Created:** [March 11, 2016, 7:22am UTC](https://discuss.elastic.co/t/query-slowness-issue-in-es-1-7-1/44119 "2016-03-11T07:22:33Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)
#### Post date: [March 11, 2016, 7:22am UTC](https://discuss.elastic.co/t/query-slowness-issue-in-es-1-7-1/44119/1 "2016-03-11T07:22:33Z")

</div>

Hi Experts ,

My kibana is very slow , it takes 15 -30 sec to show data , so I was cheeking the ES1.7.1 **search slow logs**. This is what I found , please help me to understand what could be the cause of this slowness.  
`[2016-03-11 01:48:17,639][WARN][index.search.slowlog.query] [Free Spirit] [cef-2016-03-10][1] took[23.4s], took_millis[23466], types[], stats[], search_type[COUNT], total_shards[5], source[{"query":{"filtered":{"query":{"query_string":{"query":"*","analyze_wildcard":true}},"filter":{"bool":{"must":[{"query":{"match":{"priority":{"query":"High","type":"phrase"}}}},{"query":{"query_string":{"analyze_wildcard":true,"query":"*"}}},{"range":{"rt":{"gte":1457074687975,"lte":1457679487975}}}],"must_not":[]}}}},"size":0,"aggs":{"2":{"terms":{"field":"alertmsg","size":50,"order":{"_count":"desc"}}}}}], extra_source[],`

My Resources are

> RAM total :- 32 GB  
> ES heap size :- 9 GB  
> Data :- CISCO , ASA, Damballa logs ..etc and most of the fields are not analyzed with doc value true.  
> No of nodes :- 2  
> No of shards each node :-5  
> No of replicas :-1  
> Total documents :- 16714351

ES YML configrtion

```
cluster.name: e-3
transport.tcp.port: port range
http.port: Port range
discovery.zen.ping.multicast.enabled: false
discovery.zen.ping.unicast.hosts: ["IP1","IP2"]
index.search.slowlog.threshold.query.warn: 10s
index.search.slowlog.threshold.fetch.warn: 1s
index.indexing.slowlog.threshold.index.warn: 10s

```

I do not see any errors in ES logs except warning in the slow logs.Please help me to understand what causes this slowness .

Regards  
Vikas

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 11, 2016, 7:38am UTC](https://discuss.elastic.co/t/query-slowness-issue-in-es-1-7-1/44119/2 "2016-03-11T07:38:21Z")

</div>

I'm unsure but I think that `{"query_string":{"query":"*","analyze_wildcard":true}}` could be slow and IIRC have been optimized a lot in 2.x series (like replaced by a `match_all` query).

---

<div class="post-metadata">

### Author: ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)
#### Post date: [March 11, 2016, 7:45am UTC](https://discuss.elastic.co/t/query-slowness-issue-in-es-1-7-1/44119/3 "2016-03-11T07:45:16Z")

</div>

thanks for the quick response ,interesting finding . What if I use boost along with match all , something like "match\_all" : { "boost" : 1.2 }} ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:09pm UTC](https://discuss.elastic.co/t/query-slowness-issue-in-es-1-7-1/44119/4 "2017-07-05T23:09:15Z")

</div>


