Slow aggregation queries, only after data change (ES 2.3)

it helps a little but you have to look at the OS/Hardware at this point

24M records / 6 shards / 3 nodes = 1 million records each shard is searching.

So, you will probably have some Load average and IO on each system that you should check as that will have the most impact on searchs

The other is what your actual search is (Can you provide an example) but in general if your using lots of * or doing _all fields will slow you down

Try reading this document before we go much further