Filebeat: Netflow dashboard is unresponsive and slow

[fkelbert]

Filebeat 7.10

Filebeat ships with default dashboards for Netflow data (e.g., "Autonomous systems" dashboard). These seems to be unoptimized and are thus unresponsive and very slow in loading.

Two aspects that seem to contribute to the slowness:

• query_string: * is generating a ConstantScore(DocValuesFieldExistsQuery(<field>)) for every field
• Pie charts are creating 50x50 terms aggregations

Removing query_string: * and modifying the visualisations to return less buckets significantly speed up the dashboard. There might be other aspects than can be improved. Other Netflow dashboards might also be in need of optimizations.

cc: @sachin-frayne

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.