Kibana dev here, also surprised by your experience. I have 1 million web log documents stored in elasticsearch right now, running on my macbook, and Kibana runs quite fast IMO. Would love to debug this further if you wouldn't mind filing an issue on Github.
Thank you, I will.
Re:Working with the ELK stack
by greenonion on Friday February 06, 2015 @10:20AM
(#9009340)
While I do not know the specifications of your Elasticsearch cluster, I am really surprised by your experience.
We (at skroutz.gr) use a moderately small cluster (four nodes) and easily process > 4 million rows a day and view them on Kibana dashboards in real-time. We also have success running aggregations on data going back as far as 3 months.
I'd be curious to look into this further. We use the ELK stack for SSH honeypots and have had traffic spikes of 10,000 login attempts in 10 minutes. All this is processed one a single server with a single cpu and 16GB of ram.
How big was the record for each of the customers? The only thing I can think of was that the records were much bigger than typical.
As others have mentioned, I think this may be caused by something else.
Just now I pulled up 711,117 records in Kibana (in a jiffy). And the instance this query ran on isn't particularly fast, I should add.
But that didn't work. Kibana was unusable. With 75,000 records it never loaded. Not in anyone's browser. So I cut that in half, to 36,000 records. And still, it never loaded. So I kept cutting the amount. And eventually I got down to 10,000 records. Then it loaded, but was so slow no one could use it. So finally I cut it down to 7,000 records. Now it loaded, and it was fast enough that we could use it.
To do the real analysis, I ended writing another script that dumped out the 75,000 records as a CSV file, then I uploaded it to a spreadsheet on Google Docs. This worked fine.
I am curious why Google spreadsheets can render 75,000 records, but Kibana can not? I am also curious what the real use case is for Kibana? If it can't handle large datasets, then its ability to make pretty charts seems useless -- we could never get the data in there to make the chart. I assume that other people will do what I did, and use a spreadsheet instead.