From 19844c2540999c223a771bc259a6d59dc2650e48 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 9 Jan 2024 17:24:00 -0500 Subject: [PATCH] Update docs/events/timeline-ui-overview.asciidoc --- docs/events/timeline-ui-overview.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/events/timeline-ui-overview.asciidoc b/docs/events/timeline-ui-overview.asciidoc index f6da72d586..2bcd9426ca 100644 --- a/docs/events/timeline-ui-overview.asciidoc +++ b/docs/events/timeline-ui-overview.asciidoc @@ -217,7 +217,7 @@ This query does the following: ** Then, the query limits the output to the top 10 results. ** Finally, it keeps the default `@timestamp`, `message`, `event.category`, `event.action`, `host.name`, `source.ip`, `destination.ip`, and `user.name` Timeline fields in the output. + -TIP: When querying large indices (for example, `logs-*`), performance can be impacted by the number of fields being returned in the output. If your query is taking a long time to complete, try using the {ref}/esql-commands.html#esql-keep[`KEEP`] command and specifying the fields you want returned. For example, add the clause `KEEP @timestamp, user.name` to the end of your query to specify that you only want the `@timestamp` and `user.name` fields returned. +TIP: When querying indices that tend to be large (for example, `logs-*`), performance can be impacted by the number of fields being returned in the output. To optimize performance, we recommend using the {ref}/esql-commands.html#esql-keep[`KEEP`] command to specify fields that you want returned. For example, add the clause `KEEP @timestamp, user.name` to the end of your query to specify that you only want the `@timestamp` and `user.name` fields returned. NOTE: An error message displays when the query bar is empty.