Stop Kibana Discover Auto Search

Elastic Stack Kibana
1

Hello,
I am looking for a way to stop Kibana from automatically searching, or refreshing the last search, when a user clicks on the Discover (or Dashboard or Visualize, etc) and instead only trigger the search when the user clicks the search button on the page.

I have huge sets of data and my infrastructure is not yet at the place to handle it all so any way I can save some cycles would be nice.

Thanks!

2

Hi,

Before Kibana had a home page, people would always come to the Discover page first whenever they opened Kibana. We heard a lot of people say they had a problem like what you say. Now, the home page smoothes it out by not making Discover the default start page. But I think what you're talking about is when people are navigating around in the different parts of Kibana.

Talking ES performance, is Kibana's index pattern used here one that would cover a large number of indices or shards? If you have a pattern like logs-* where * is a timestamp, and the records go back 1 year ago, then you'd be telling ES to check against all the shards found in 365 different indices. Let's say you have the default index settings of 5 shards per index, ES is hitting 1825 shards. That might not sound like a lot, but also take into consideration the size of the shards in GB. If they're around 50GB each or more, you're starting to really depend on the ES hardware to having really good performance and capacity.

Some thoughts that could help:

  1. Default index pattern? I hope that this index pattern is not Kibana's default, or else that search will trigger any time you open Discover the first time.
  2. Last URLs: Kibana has a concept of lastUrl and lastSubUrl. When you're in Discover and select an index pattern, the next time you return to Discover you'll see the same index pattern again because it is tracked as one of those last URLs in the browser local storage. Avoid getting that index pattern persisted in local storage: whenever you open it, use an Incognito mode browser, and close the browser when you're done. Incognito does not persist local storage across sessions.
  3. Querying performance: to reduce the number of shards ES reads from in a search would be to refine the index pattern down to being as specific as possible. For example, if your index name is logs-2019.01.24, you just have 1 prefix and 1 suffix. You can change the names of the indices to have multiple prefixes or multiple suffixes. (For example: logs-arizona-*, logs-arizona-*,logs-ohio-*, logs-*-windows-*)

Unfortunately #3 is more of a solution for custom applications that use ES, but not so much for Kibana, because it would be a pain to have to create a new index pattern so frequently, and you could end up with very very many.

When it comes down to it, the best options you could hope for would be to get dramatic improvement in querying (scaling the ES cluster up will help) or have an enhancement implemented in Kibana to make search not happen automatically.

Sorry I don't have a perfect answer here, but I hope something here does help

3

Thank you very much for the response. You are correct, I am referring to navigating to the different Kibana applications. Not only navigating the different applications but in many cases, a parameter change such as modifications to time or a filter setting automatically submits the form. In my case, if there are several changes that need to be made to the search query, multiple submits can become very painful.

Your suggestions will be helpful and I will attempt to submit for an enhancement.

Thanks again!

4

Sure thing! I hope it really does help.

If you file an enhancement, feel free to link it here and I'll be quickly notified. I can chime in if it might help.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.