A special dashboard ... performance issues

[antoinecaron]

Hi again man,

Now that I've sent you a couple general bugs, I'd like to talk about the problems i encounter with my special dashboard ...

I am charged with implementing PCI DSS in our company and basically i was hoping to built a SIEM like environment with Kibana. So the way it is layed out is basically that there will be 5 or 6 sections with this section layout:

[ TEXT ]
[TREND][TREND][TREND][TREND][TREND][TREND]
[ HISTOGRAM ]
[ MAP ][ PIE ][ PIE ][ PIE ]
[ TABLE ]

Was working well at first, but then i encountered very very bad performance issues with Kibana v3 shipped with logstash. I updated to the latest git version, it is still a bit slow, but now it is effectively usable. So that is a good thing. Would there be a way for you to further improve performance ? Maybe you are going to suggest to create separate dashboards for each section, though if I do that I will lose the ability to do cross-corelation between the different sections, and thats exactly what I dont want.

Example: I see a weird event going on in the "Firewall" section and I filter on an IP address, I want to be able to see the data filtered in the "Authentication" or "Snort" sections and see if something funky is also going on in these in relation to that selected IP addess.

Two other problems in that setup:

• switching between the tabs ("Panel", "Queries", etc.) in the configuration of a panel is highly unresponsive
• the scroll top occuring when opening the configuration of a panel is the most annoying thing ever. Because my dashboard has effectively an important vertical scrolling, i have to scroll back down each time I finished setting up a panel. Make it fixed ?

Let me know your thoughts about all this.

Here are a couple ideas I thought would be useful for the tables:

• ability to set up a column label / title rather than directly using the field name
• ability to set a fixed width on a column. Example my "source port" column takes much more space than needed and that truncates the text of some other columns.

Cheers,

Antoine.

[german23]

+1 also got a similar performance problem while switching between Tabs in a configuration panel of a table

[rashidkpc]

This is usually caused by a very large number of fields. Given that this ticket includes several enhancement requests as well, I'm going to close it. Feel free to open separate issues that are scoped to a specific behavior/request.