Troubleshooting for system performance

If you are experiencing problems with system performance, there are actions that you can take to improve your system’s response times.

Improving the Siren Investigate UI performance

You can modify a number of system performance settings by selecting ManagementData ModelOptions.

You can also modify some key parameters by selecting ManagementAdvanced settings.

The following tips can help you to improve the performance of the UI:

Client-side compression

If users who are accessing Siren Investigate have a poor internet connection with slow upload speeds, you can enable client-side compression to speed up some large HTTP requests.

+ Open the config/investigate.yml file and set the compression_enabled parameter to ‘true’ as follows:


  compression_enabled: true
  compression_threshold: 1024 // This is the size limit of the request body in bytes. If this limit is exceeded, compression is triggered.
  logging_enabled: true

Time settings

  • If time precision is not a high priority, you can change the value of the siren:timePrecision parameter in Advanced settings to a greater value than its current setting. This improves the Elasticsearch cache hits, because the time is not drifting.

  • You can avoid time drift, by using absolute time rather than relative time.

    Open your dashboard in Edit mode and select the clock icon in the top-right of the screen. In the Time Range panel, select Absolute, click Apply to all dashboards and Save.

  • If you have dashboards with large time-based indices, save them with the time range set to the shortest feasible time. By doing so, you can avoid sending queries that will have to aggregate on all historical data when the user opens the dashboard for the first time.

    In Advanced Settings, set the timepicker:timeDefaults parameter as required.

  • When you are configuring histogram visualizations, ensure that the time range is not too small. For example, do not configure a time range in minutes if you are displaying a histogram that spans many years of data.

Query limitation settings

  • If you have dashboards that are based on large indices, set limits to prevent generating queries that might slow down your system. There are three limits that you can set on an Index Pattern Search:

    • The maximum time range.

    • The maximum number of documents on a dashboard when no joins are involved.

    • The maximum number of documents on a dashboard when a join is involved.

      You set these limits by clicking ManagementData ModelOptions.

  • When you are configuring an Index Pattern Search, you can set source filters to exclude the fields that you do not want to fetch. For example, exclude fields that contain binary data or long strings that would make the responses too large. You set the source filters by clicking ManagementData ModelOptions.

  • If your installation contains many dashboards, organize them into groups. Groups can be collapsed, which reduces the number of count queries.

Graph Browser settings

In the Graph Browser, you can set a graph expansion limit, which controls how many records can be imported into a graph from a dashboard. This is called sampling.

For more information, see Sampling data in the graph.

Automation settings

  • If the automatic count on relational buttons is taking a long time to display, you can disable this feature. As a result, users will have to press the button to see the count.

    In Advanced Settings, set the siren:enableAllRelBtnCounts parameter to 'false' by deselecting the checkbox.

Improving the Siren Federate back-end system performance

The following tips can help you to improve the performance of the Siren Federate back-end system:

  • Use the smallest feasible number of shards per index. For more information, see Tune for indexing speed in the Elasticsearch documentation.

  • Optimize your search speed. For more information, see Tune for search speed in the Elasticsearch documentation.

  • Make the recommended configurations in the Siren Federate plug-in. For more information, see the Performance considerations section of the Siren Federate user guide.