I was reading through the following post and had some follow up questions:
When running long time range queries / more complex queries in Kibana, I receive the following error:
Fatal Error: Courier fetch: Request Timeout after 30000ms
I'd like to set the following value in
kibana.yml to address my issue:
elasticsearch.shardTimeout: 30000 (30 seconds)
elasticsearch.shardTimeout: 300000 (5 minutes)
Will I run into any performance issues that could make my system unresponsive / require a reboot? When I run these queries my system's load jumps up to a maximum of 80% CPU utilization or a load average of 4.
I don't mind if the queries take longer than 30 seconds.
A little background on my Elastic Stack setup:
I'm using Elasticsearch, Logstash, Kibana, and Winlogbeat all version 6.4.0.
I have around 10 million / 7.5 GB worth of documents on my single node Elastic Stack setup. The system specifications are 2 CPU / 8GB RAM. I've implemented some methods to improve the performance of Elasticsearch, such as setting JVM Heap to 4GB, preventing memory swapping, etc.
However, since my indices are growing past the 10 million document mark, the performance of my node is beginning to stagger when I run queries with multiple filters (no wildcards) and longer time ranges (over one week). I know this is pretty normal, especially given the system specifications that I'm bound to. I'll upgrade to a cluster / add more CPU and memory later down the line.
Thanks for reading!