I'm working through some performance concerns in my cluster, and I turned
on the slow log feature. I'm seeing this in the index_search_slowlog.log
log:
Is that a user generated search, or something internal to ES maybe? I
can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
There is no such thing as query "internal to ES", if you see this in the
logs you have a client making it. I would point to a Kibana instance but
I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a decent
sized installation.
I'm working through some performance concerns in my cluster, and I turned
on the slow log feature. I'm seeing this in the index_search_slowlog.log
log:
Is that a user generated search, or something internal to ES maybe? I
can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
Very strange query indeed. Wildcard search filtered by a match_all. What?!?
It is not Elasticsearch, but perhaps some plugin. Itamar mentioned Kibana,
although you did not mention it in your post. Any other plugins? Marvel?
--
Ivan
On Wed, Aug 20, 2014 at 12:43 PM, Itamar Syn-Hershko itamar@code972.com
wrote:
There is no such thing as query "internal to ES", if you see this in the
logs you have a client making it. I would point to a Kibana instance but
I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a decent
sized installation.
I'm working through some performance concerns in my cluster, and I turned
on the slow log feature. I'm seeing this in the index_search_slowlog.log
log:
Is that a user generated search, or something internal to ES maybe? I
can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
I thought of Kibana because there's a faceting operation on the _type
field. But I doubt neither Marvel nor Kibana would issue such an awful
query (notice the "fquery" bit, too).
Any part of your system (plugin or other) which might want to look at the
types of documents added to an ES index?
On Wed, Aug 20, 2014 at 11:53 PM, Ivan Brusic ivan@brusic.com wrote:
Very strange query indeed. Wildcard search filtered by a match_all. What?!?
It is not Elasticsearch, but perhaps some plugin. Itamar mentioned Kibana,
although you did not mention it in your post. Any other plugins? Marvel?
--
Ivan
On Wed, Aug 20, 2014 at 12:43 PM, Itamar Syn-Hershko itamar@code972.com
wrote:
There is no such thing as query "internal to ES", if you see this in the
logs you have a client making it. I would point to a Kibana instance but
I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a decent
sized installation.
I'm working through some performance concerns in my cluster, and I
turned on the slow log feature. I'm seeing this in the
index_search_slowlog.log log:
Is that a user generated search, or something internal to ES maybe? I
can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
Thanks guys for the thoughts. Plugins didn't even occur to me, but they
should have.
We've got Marvel, Head, and ElasticHQ installed.
Is there some way to tell where the search is coming from? Something like
an HTTP access log or something?
Thanks again for your time!
Chris
On Wed, Aug 20, 2014 at 3:57 PM, Itamar Syn-Hershko itamar@code972.com
wrote:
I thought of Kibana because there's a faceting operation on the _type
field. But I doubt neither Marvel nor Kibana would issue such an awful
query (notice the "fquery" bit, too).
Any part of your system (plugin or other) which might want to look at the
types of documents added to an ES index?
On Wed, Aug 20, 2014 at 11:53 PM, Ivan Brusic ivan@brusic.com wrote:
Very strange query indeed. Wildcard search filtered by a match_all.
What?!?
It is not Elasticsearch, but perhaps some plugin. Itamar mentioned
Kibana, although you did not mention it in your post. Any other plugins?
Marvel?
--
Ivan
On Wed, Aug 20, 2014 at 12:43 PM, Itamar Syn-Hershko itamar@code972.com
wrote:
There is no such thing as query "internal to ES", if you see this in the
logs you have a client making it. I would point to a Kibana instance but
I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a decent
sized installation.
I'm working through some performance concerns in my cluster, and I
turned on the slow log feature. I'm seeing this in the
index_search_slowlog.log log:
Is that a user generated search, or something internal to ES maybe? I
can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
Thanks guys for the thoughts. Plugins didn't even occur to me, but they
should have.
We've got Marvel, Head, and ElasticHQ installed.
Is there some way to tell where the search is coming from? Something like
an HTTP access log or something?
Thanks again for your time!
Chris
On Wed, Aug 20, 2014 at 3:57 PM, Itamar Syn-Hershko itamar@code972.com
wrote:
I thought of Kibana because there's a faceting operation on the _type
field. But I doubt neither Marvel nor Kibana would issue such an awful
query (notice the "fquery" bit, too).
Any part of your system (plugin or other) which might want to look at the
types of documents added to an ES index?
On Wed, Aug 20, 2014 at 11:53 PM, Ivan Brusic ivan@brusic.com wrote:
Very strange query indeed. Wildcard search filtered by a match_all.
What?!?
It is not Elasticsearch, but perhaps some plugin. Itamar mentioned
Kibana, although you did not mention it in your post. Any other plugins?
Marvel?
--
Ivan
On Wed, Aug 20, 2014 at 12:43 PM, Itamar Syn-Hershko <itamar@code972.com
wrote:
There is no such thing as query "internal to ES", if you see this in
the logs you have a client making it. I would point to a Kibana instance
but I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a
decent sized installation.
I'm working through some performance concerns in my cluster, and I
turned on the slow log feature. I'm seeing this in the
index_search_slowlog.log log:
Is that a user generated search, or something internal to ES maybe? I
can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
Thanks guys for the thoughts. Plugins didn't even occur to me, but they
should have.
We've got Marvel, Head, and ElasticHQ installed.
Is there some way to tell where the search is coming from? Something
like an HTTP access log or something?
Thanks again for your time!
Chris
On Wed, Aug 20, 2014 at 3:57 PM, Itamar Syn-Hershko itamar@code972.com
wrote:
I thought of Kibana because there's a faceting operation on the _type
field. But I doubt neither Marvel nor Kibana would issue such an awful
query (notice the "fquery" bit, too).
Any part of your system (plugin or other) which might want to look at
the types of documents added to an ES index?
On Wed, Aug 20, 2014 at 11:53 PM, Ivan Brusic ivan@brusic.com wrote:
Very strange query indeed. Wildcard search filtered by a match_all.
What?!?
It is not Elasticsearch, but perhaps some plugin. Itamar mentioned
Kibana, although you did not mention it in your post. Any other plugins?
Marvel?
--
Ivan
On Wed, Aug 20, 2014 at 12:43 PM, Itamar Syn-Hershko < itamar@code972.com> wrote:
There is no such thing as query "internal to ES", if you see this in
the logs you have a client making it. I would point to a Kibana instance
but I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a
decent sized installation.
I'm working through some performance concerns in my cluster, and I
turned on the slow log feature. I'm seeing this in the
index_search_slowlog.log log:
Is that a user generated search, or something internal to ES maybe?
I can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
This is actually Kibana. The reason it uses query_string is to allow people
some kind of syntax in their query with no query parsing on the client
side. Just a decision which I guess was made long ago to keep things simple.
Is this a problem for you in any way?
Cheers,
Boaz
On Thursday, August 21, 2014 6:37:02 PM UTC+2, Chris Neal wrote:
Done. Will report back.
Thank you!
On Thu, Aug 21, 2014 at 11:27 AM, Itamar Syn-Hershko itamar@code972.com
wrote:
I'm going to bet on Head. Disable it and see what happens.
Thanks guys for the thoughts. Plugins didn't even occur to me, but they
should have.
We've got Marvel, Head, and ElasticHQ installed.
Is there some way to tell where the search is coming from? Something
like an HTTP access log or something?
Thanks again for your time!
Chris
On Wed, Aug 20, 2014 at 3:57 PM, Itamar Syn-Hershko itamar@code972.com
wrote:
I thought of Kibana because there's a faceting operation on the _type
field. But I doubt neither Marvel nor Kibana would issue such an awful
query (notice the "fquery" bit, too).
Any part of your system (plugin or other) which might want to look at
the types of documents added to an ES index?
On Wed, Aug 20, 2014 at 11:53 PM, Ivan Brusic ivan@brusic.com wrote:
Very strange query indeed. Wildcard search filtered by a match_all.
What?!?
It is not Elasticsearch, but perhaps some plugin. Itamar mentioned
Kibana, although you did not mention it in your post. Any other plugins?
Marvel?
--
Ivan
On Wed, Aug 20, 2014 at 12:43 PM, Itamar Syn-Hershko < itamar@code972.com> wrote:
There is no such thing as query "internal to ES", if you see this in
the logs you have a client making it. I would point to a Kibana instance
but I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a
decent sized installation.
I'm working through some performance concerns in my cluster, and I
turned on the slow log feature. I'm seeing this in the
index_search_slowlog.log log:
Is that a user generated search, or something internal to ES maybe?
I can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
Thanks for the reply. It's not a problem per-se. I'm working through
performance/memory issues and turned on the slow log file and that one
popped up. It's a problem because it's slow, but not causing cluster
stability issues!
It's interesting that you think it is Kibana though. I removed the Head
plugin for 3 days and didn't see that query logged once, so I was pretty
sure it was the culprit! Maybe it was just coincidence that whatever in
Kibana was doing it didn't happen then either. Just my luck.
This is actually Kibana. The reason it uses query_string is to allow
people some kind of syntax in their query with no query parsing on the
client side. Just a decision which I guess was made long ago to keep things
simple.
Is this a problem for you in any way?
Cheers,
Boaz
On Thursday, August 21, 2014 6:37:02 PM UTC+2, Chris Neal wrote:
Done. Will report back.
Thank you!
On Thu, Aug 21, 2014 at 11:27 AM, Itamar Syn-Hershko itamar@code972.com
wrote:
I'm going to bet on Head. Disable it and see what happens.
I thought of Kibana because there's a faceting operation on the _type
field. But I doubt neither Marvel nor Kibana would issue such an awful
query (notice the "fquery" bit, too).
Any part of your system (plugin or other) which might want to look at
the types of documents added to an ES index?
On Wed, Aug 20, 2014 at 11:53 PM, Ivan Brusic ivan@brusic.com wrote:
Very strange query indeed. Wildcard search filtered by a match_all.
What?!?
It is not Elasticsearch, but perhaps some plugin. Itamar mentioned
Kibana, although you did not mention it in your post. Any other plugins?
Marvel?
--
Ivan
On Wed, Aug 20, 2014 at 12:43 PM, Itamar Syn-Hershko < itamar@code972.com> wrote:
There is no such thing as query "internal to ES", if you see this in
the logs you have a client making it. I would point to a Kibana instance
but I'm pretty sure Kibana won't use a query_string query like this.
And yes this is quite an expensive query (and facets) to run on a
decent sized installation.
I'm working through some performance concerns in my cluster, and I
turned on the slow log feature. I'm seeing this in the
index_search_slowlog.log log:
Is that a user generated search, or something internal to ES maybe?
I can't even tell what it's trying to do. It seems to hit every one of my
indexes though, as the same search query is logged 63 times in a one minute
period.
Any ideas what this is? Is it something to be concerned about?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
It's not a problem per-se. I'm working through