I am trying to understand how the following elastic-search setting works:
search.default_search_timeout
I tried to configure this value on a cluster but I couldn't actually limit down to a desired level the time a query takes. The timeout occurs and a query gets stopped but still lasts longer than expected. It seems that there is some relation of default_search_timeout value to the actual occurring timeout but it doesn't feel like a linear relation, or anyway I don't understand how it works. I got 2m lasting queries for a 15s default_search_timeout configuration.
Any ideas on how to understand better this topic?
All I need is to restrict a long-lasting kibana query from overloading my elastic-search cluster.
Other ideas would be much appreciated.
Note: Using elasticsearch version 2.2.0 and applied the setting via REST api (in the transient group)