Potential revision

elastic · Jan 9, 2024 · dbbff14 · dbbff14
1 parent 6fcc832
commit dbbff14
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/docs/events/timeline-ui-overview.asciidoc b/docs/events/timeline-ui-overview.asciidoc
@@ -216,6 +216,8 @@ This query does the following:
 ** It starts by querying documents within the Security alert index (`.alerts-security.alerts-default`) and indices specified in the <<update-sec-indices,Security data view>>.
 ** Then, the query limits the output to the top 10 results.
 ** Finally, it keeps the default `@timestamp`, `message`, `event.category`, `event.action`, `host.name`, `source.ip`, `destination.ip`, and `user.name` Timeline fields in the output.
++
+TIP: When querying indices with a large number of fields (for example, `logs-*`), performance can be impacted by the number of fields being returned in the output. If your query is taking a long time to complete, try using the {ref}/esql-commands.html#esql-keep[`KEEP`] command and specifying the fields you want returned. For example, add the clause `KEEP @timestamp, user.name` to the end of your query to specify that you only want the `@timestamp` and `user.name` fields returned.
 
 NOTE: An error message displays when the query bar is empty.