Skip to content

Filter Editor Suggestions can take forever and drastically increase the load in a cluster. #12692

@trevan

Description

@trevan

I'm currently upgrading to the latest master and noticed the Filter Editor suggestions from #11375. I looked at the search requests that it makes and there is a BIG problem. I took one of the search requests and ran it against our production data to see how it would fair. I let it run for 3 minutes before I killed it and then took the next several minutes trying to keep the cluster a float. All nodes in our cluster had their load average go from the 20's to the 70's.

I think the main issues are that:

  1. It doesn't have any time filter. It searches across all shards. In my case, we have 6000 shards.
  2. It runs an aggregation for any searchable fields. This includes fields that use "fielddata".

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions