Skip to content
This repository was archived by the owner on Dec 5, 2025. It is now read-only.
This repository was archived by the owner on Dec 5, 2025. It is now read-only.

[Bug] Count queries scrolls thru all elasticsearch index  #2496

@gfmellado

Description

@gfmellado

Hello everyone! We have an issue: when we filter by native fields (like date, source, severity, etc.) the count query response time takes a normal amount of time (fast), but when we filter by custom fields, we think it scrolls thru all index database (elasticsearch) and two possible scenarios occur:

  1. when the count number is greater than the query threshold (query.limitedCountThreshold: 1000) it stops when it reaches that limit.
  2. when the count number is lower than the query threshold (query.limitedCountThreshold: 1000) it ends up scrolling thru all index database in order to get the definitive number.

The second scenario takes a lot of time and really stresses the platform.

What can we do to improve this situation? If we do a reindex, does custom fields get reindexed?

Thanks in advance for any help.

Metadata

Metadata

Assignees

No one assigned

    Labels

    TheHive4TheHive4 related issuesbug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions