the environment uses 170 lookups and during one single search, they get loaded exactly 500 times each wich sums up to thousands of times in total and a search job total of 800mb as long as we type index=*. I know I know, you shouldn't do that, but our customer did and this obviously is a bug (selfmade?). Btw: All lookups are set to global.
What happens here? How can we change it?
Thank you 🙂
changing the search type doesn't change anything unfortunately. But I got closer to the answer: We do have 506 Indizes and all Lookups get loaded for every single Index..... we will be starting a campaign for the employees: Specify the Index 🙂
I think you may have one more issue to look-at. Look-ups (even if they are global and automatic) should be normally restricted to one sourcetype (can't see why we would enable across sourcetypes). So, you may want to look at that as well. Also, for users, you can default 'indexes' to search in the roles definition. So, if anyone uses index=* , it will restrict them to default ones, as opposed to search across all indexes, till the education/campaign is successful.