[Monitoring] Index listing page times out for large monitoring/metricbeat clusters

[chrisronline]

It's slow as a result of starting to search across .monitoring-* and metricbeat-* indices.

After some digging, it seems that the sort for inner_hits is adding a considerable amount of time to the query.

The fix is to add the unmapped_type property to the sort clause which then immediately speeds up the query.

Because of this, our thinking is that because the metricbeat-* indices do not currently have the sort field in it's mappings (timestamp), Elasticsearch isn't handling something properly here. What is going on? I don't really know and I'm following up with @jimczi

[elasticmachine]

Pinging @elastic/stack-monitoring (Team:Monitoring)