Allow Expensive Queries
The cluster permits expensive query types such as broad regex and heavy scripted searches. Those workloads can spike CPU and heap and slow routine search and indexing on shared nodes.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Cluster |
| Domains | performance, search, configuration |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
No description available.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Disable expensive queries
Condition: Always shown for this insight.
Set search.allow_expensive_queries to false only after you confirm no Kibana features you rely on need expensive queries (for example alerting or Fleet setup). Regex and scripted queries use heavy CPU and memory; blocking them can protect cluster stability but might break some searches.
Impact: This might slow down search operations and affect the stability of the cluster. By default, this setting is set to true. There are some queries that require a high amount of CPU and memory resources to run (such as regex and scripted queries). These could possibly slow down other search and indexing operations.