I would try to change subqueries to left joins.

Apart from that I would extract SQL query you're running here and run EXPLAIN on it.

Sorry but I can't understand clear your sentence "I would try to change subqueries to left joins".

When I look into my mysql log. Elgg will call 

SELECT DISTINCT rv.* FROM elgg_river rv JOIN elgg_entities object ON object.guid = rv.object_guid WHERE rv.object_guid IN (SELECT guid_two FROM elgg_entity_relationships WHERE guid_one=1551 AND relationship='enroll')
OR rv.subject_guid = 1551
OR rv.subject_guid IN (SELECT guid_two FROM elgg_entity_relationships WHERE guid_one=1551 OR guid_two=1551 AND relationship='classmate')
OR rv.subject_guid IN (SELECT guid_one FROM elgg_entity_relationships WHERE guid_two=1551 OR guid_two=1551 AND relationship='friend') AND ( (rv.access_id = -2
AND rv.subject_guid IN (
SELECT guid_one FROM elgg_entity_relationships
WHERE relationship='friend' AND guid_two=1551
)) OR (rv.access_id IN (2,1)
OR (rv.subject_guid = 1551)
OR (
rv.access_id = 0
AND rv.subject_guid = 1551
)
) ) ORDER BY rv.posted desc LIMIT 0, 20;

And when I run "EXPLAIN" command there are one point that I concern is 

Using where; Using temporary; Using filesort 

Using where; Using index; Distinct 

I don't know how to improve. My team plan will add one or two more tables to remove JOINS

If you're using the elgg ajax function: elgg.action() it's all taken care of for you

Hi Matt,

I saw in the lib a snippet code

    // This is a misuse of elgg.security.addToken() because it is not always a
    // full query string with a ?. As such we need a special check for the tokens.
    if (!elgg.isString(options.data) || options.data.indexOf('__elgg_ts') == -1) {
        options.data = elgg.security.addToken(options.data);

That means elgg.action will add the token for us. But I concern that  in server side, do we need to take care the token or ELgg will help us about it ?

If you're using the action pagehandler it'll be checked