Slow Kibana Dashboard

[N31LR]

I have a kibana visualisation that runs a query containing a wildcard

{
"query_string": {
"query": "system.auth.message:Connection closed*preauth\]",
"analyze_wildcard": true
}
}

When this query is ran in visualise page Query Duration = 100 ms and Request Duration = 180 ms
When the visualisation is added to a dashboard (as the sole visualisation, no others exist on the dashboard), the dashboard and visualisation takes 15 seconds + to load.

Any ideas why the duration's would differ to such an extent?

Thanks

[jbudz (Jon Budzenski)]

If it's the same visualization times should be very similar so I'm not sure offhand. Both requests will use an msearch, the difference being a dashboard tends to have more than one visualization requests.

Can you open the network tab in your developer tools and share the response times in dashboard vs visualize?

Can you also share your kibana version?

[N31LR]

@N31LR

system.auth.message:Connection closed*preauth]

Hi Jon.

These are the msearch times from the visualisation screen, I ran it a few times to get the average, excluding the first run of 916ms once cached all others take around 100ms.

There are the msearch times for the dashboard screen, it only contains the one visualisation for testing this. again it was ran a few times to get the average, taking around 6seconds each time.

Originally I had two wildcard characters in the query, and it was taking 12 seconds, it looks like for each * character added to the query, and additional 6 seconds is added to the query duration. Which I understand as a wildcard would be less performant. However this wouldn't explain the difference in duration between the visualisation screen and dashboard screen.

I am running kibana 5.4.1

Thanks