You should tweak cache sizes. At least the field data cache needs to be restricted (unbounded by default). Also, ensuring the various circuit breakers are turned on will help. Another tip is to disable the _all field if you don't need it.
All this should reduce the amount of memory ES uses and make it less likely your cluster becomes unavailable. We use Elasticsearch with Kibana in our production setup. Things definitely do not fail gracefully if you run short of memory; so you need to prevent that situation. I've had a completely unresponsive cluster on two occasions. With the current settings, it has been running stable for several weeks now. I've learned a few of these things the hard way. I think a ES tuning guide for non experts is desperately needed. The out of the box experience is not really appropriate for any serious production environment. But then, you wouldn't run mysql with default settings in production either. In my experience, you currently need to piece together bits of good advice spread through the documentation and various forum posts. If you have an untuned Elasticsearch in production there are several failure scenarios that are likely to result in unavailability and data loss. Especially if you are using ELK with lots of log data, you need to tune or you basically will have a dead cluster in no time due to OOMs. Jilles On Monday, June 30, 2014 5:04:12 PM UTC+2, AlexK wrote: > > Hi, > > I am using ES version 1.1.1 on a *single node* with the below settings: > - 2 shards per indices; > - currently 395 indices; > - currently *428GB*; > - *18GB* Heap commited on a 24 GB machine; > > I used it only for indexing now, because I noted some memory issues when > performing search: elasticsearch became unresponsive... > My requirement curently is to use ElasticSearch only on a single machine > configuration. > > I already tried to tune the JVM (Xmn to 2gb, noting Full Garbarge > Collector very often) whithout success. > > Does anyone have some advices for me ? > > 1. Is the only way is to increase the heap (do you have a ratio RAM / data > size) ? > 2. Does adding additional nodes on the same machine will help, why ? > 3. Final question, I cannot see why in the indexing part so much of the > RAM is used, if anybody can explain ? > > Thanks a lot for your answers. > Alex. > > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/5e79bff1-409e-4389-8be3-69590f3ffb56%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
