Not sure if this belongs in the Kibana or Elasticsearch section...
I currently have 33 hosts reporting Winlogbeat and MetricBeat data to a single node ElasticStack setup. Total index size for these two comes in at about 30GB per day and about 100 million documents. Our VM has lots of fast storage, 20GB of RAM and 6 2.4GHz CPUs. If I try to look at 24 hours worth of metrics using the
[Metricbeat System] Overview example dashboard, I get timeouts on the search (Kibana is configured with a two minute timeout). Same behavior with the WinlogBeat example dashboard.
Three questions come from this:
When I specify a time frame, is Kibana only looking at a part of the index that spans that time, the whole index, or all indexs that match the index pattern? (In my case, metricbeat-* or winlogbeat-*)
Is this kind of performance in line with expectations?
Other than building up/out the infrastructure, is there anything I can do to improve search performance?