Hi, I am moving from Elasitcsearch 7.13.4 to Opensearch 1.3.2. However, my Opensearch cluster is experiencing a slow query performance issue compared to the Elasticsearch cluster running in the same Kubernetes cluster. I have been sending the same syslog data to both Opensearch and Elasticsearch cluster for some weeks. It takes longer for Opensearch to return a result(Opensearch takes 26s, and Elasticsearch takes 0.3s). Do you have any suggestions for performance tunning? Thank you
[root@k3s-1 ~]# time curl -u $username:$password -sk https://10.43.80.73:9200/*syslog*/_search -H 'Content-Type: application/json' -d '{
"size": 1000,
"sort": [
{
"timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"stored_fields": [
"*"
],
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "timestamp",
"format": "date_time"
}
],
"query": {
"bool": {
"filter": [
{
"match_all": {}
},
{
"range": {
"timestamp": {
"gte": "2022-05-22T20:53:54.323Z",
"lte": "2022-06-05T20:53:54.323Z",
"format": "strict_date_optional_time"
}
}
}
]
}
}
}' | jq . >/tmp/es-syslog
real 0m0.368s
user 0m0.047s
sys 0m0.012s
[root@k3s-1 ~]# time curl -u $username:$password -sk https://10.43.218.222:9200/*syslog*/_search -H 'Content-Type: application/json' -d '{
"size": 1000,
"sort": [
{
"timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"stored_fields": [
"*"
],
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "timestamp",
"format": "date_time"
}
],
"query": {
"bool": {
"filter": [
{
"match_all": {}
},
{
"range": {
"timestamp": {
"gte": "2022-05-22T20:53:54.323Z",
"lte": "2022-06-05T20:53:54.323Z",
"format": "strict_date_optional_time"
}
}
}
]
}
}
}' | jq . >/tmp/os-syslog
real 0m26.110s
user 0m0.048s
sys 0m0.010s
[root@k3s-1 ~]# du -sh /tmp/*s-syslog
304K /tmp/es-syslog
304K /tmp/os-syslog
[root@k3s-1 ~]# kubectl get svc -A |grep 10.43.80.73
elasticsearch elasticsearch-http ClusterIP 10.43.80.73 <none> 9200/TCP 217d
[root@k3s-1 ~]# kubectl get svc -A |grep 10.43.218.222
opensearch opensearch-master ClusterIP 10.43.218.222 <none> 9200/TCP,9300/TCP 18d
[root@k3s-1 ~]#
