ES|QL performance tips for faster Kibana and Elasticsearch queries

When an ES|QL query feels slow or returns too much data, the fix is often in the shape of the pipeline. Filter early, keep only useful columns, sort only when you need deterministic order, and limit the rows returned to Kibana or the API.

FROM logs-*
| WHERE @timestamp >= NOW() - 15 minutes
| WHERE service.name == "checkout"
| KEEP @timestamp, service.name, log.level, message, trace.id
| SORT @timestamp DESC
| LIMIT 100

Why this ES|QL pattern helps

Every ES|QL pipe receives the table produced by the previous step. The earlier you reduce rows and columns, the less work later steps usually need to do. This matters most for broad index patterns, high-cardinality fields, joins, parsing, and dashboards that refresh often.

Practical performance tips

• Use a narrow time range while building and testing the query.
• Put selective WHERE clauses near the top of the pipeline.
• Use KEEP or DROP to avoid returning unnecessary fields.
• Add LIMIT for investigation tables and API calls that only need sample rows.
• Filter before expensive operations such as parsing, joins, or broad aggregations whenever possible.
• Avoid querying many indices without filters unless you truly need all matching data.

When to use it

This checklist fits Kibana ES|QL support cases, dashboard tuning, alert query review, and Elasticsearch users who are moving from raw document searches to pipeline-style analysis.

Source reference: Elastic documentation: Optimize ES|QL query performance.