i am searching for a way to accelerate dashboard
the dashboard contains 4 panels, each of them is running same search but with different time picker
i mean:
Panel 1: for 1 hour
Panel 2: for 24 hours
panel 3: for 1 week
panel 4: for 1 month
the 3 panels are taking too much time till viewing the results (line chart)
so i need such an easy way to enhance the dashboard performance
There are a few ways.
You could have post process. Set the base search to the longest time range and keep _time in the results. In the panel queries, add a clause to filter down to the correct time range. I'd probably use a relative_time eval. Then finish the query out.
Create a summary index and search that.
Create an accelerated data model to search.
Create saved searches for each panel, or I suppose, in a manner similar to what I described in scenario 1, you could create one saved search that includes _time and filter it down in each panel.
If your #4 is "Schedule the long searches to run every hour and pull in the results using loadjob
" then I agree with your answer. I would try #1, #4, #2, then #3 (#3 has a significant disk impact).