elasticsearch 上default_search_timeout 的行为

Question

我试图了解以下弹性搜索设置的工作原理：

search.default_search_timeout

I tried to configure this value on a cluster but I couldn't actually limit down to a desired level the time a query takes. The timeout occurs and a query gets stopped but still lasts longer than expected. It seems that there is some relation of default_search_timeout value to the actual occurring timeout but it doesn't feel like a linear relation, or anyway I don't understand how it works. I got 2m lasting queries for a 15s default_search_timeout configuration.

Any ideas on how to understand better this topic?

All I need is to restrict a long-lasting kibana query from overloading my elastic-search cluster.

Other ideas would be much appreciated.

Note: Using elasticsearch version 2.2.0 and applied the setting via REST api (in the transient group)

Answer 1

当搜索从一个段移动到另一段时，将检查超时值。即在段的末端边界处。超过超时值后，扫描期间将被取消

因此，如果您有一个很大的段，并且假设搜索需要 2m 来扫描第一个段直到结束，那么搜索将在 2m 处取消

还有另一种设置可以克服这种行为。引用 ES 文档。 搜索超时和取消

可以使用标准任务取消机制取消搜索。默认情况下，正在运行的搜索仅检查是否在段边界上取消，因此取消可能会因大段而延迟。通过将动态集群级别设置 search.low_level_cancellation 设置为 true 可以提高搜索取消响应能力。但是，它会带来更频繁的取消检查的额外开销，这在大型快速运行的搜索查询中可能会很明显。更改此设置仅影响更改后开始的搜索。