Before you begin reading the explanation below, try running the free Elasticsearch Health Check-Up get actionable recommendations that can improve Elasticsearch performance and prevent serious incidents. Just 2 minutes to complete and you can check threadpools, memory, snapshots and many more.
What does it mean?
High CPU is often a symptom of other underlying issues, and as such there are a number of possible causes for it.
Causes of high CPU should be investigated and fixed, because a distressed node will at best slow down query response times resulting in time outs for clients, and at worst cause the node to disconnect and be lost from the cluster altogether.
How to resolve
To minimize the impact of distressed nodes on your search queries, make sure you have the following setting on your cluster (version 6.1 and above):
PUT /_cluster/settings
{
"transient": {
"cluster.routing.use_adaptive_replica_selection": true
}
}Below are some guides that can assist you in resolving this issue:
- High CPU is generally the consequence of JVM garbage collection which in turn is caused by configuration or query related issues. For a detailed guide of JVM garbage collection, see: Heap Size Usage and JVM Garbage Collection in ES – A Detailed Guide.
- If the CPU is high only on specific data nodes, then you may have a load balancing or sharding issue. See Loaded Data Nodes – Important Elasticsearch Guide.
- CPU may also be a symptom of memory swapping to disk, if that has not been deactivated properly on the node. See: The Bootstrap Memory Lock Setting is Set to False – An Elasticsearch Guide.
- If you have a large number of shards on your cluster, then you may have an issue with oversharding. Please see the document on Shards Too Small (Oversharding) – A Detailed Guide.
- In the case of inefficient indexing (ingestion), please see the tips on indexing optimisation here: Improve Elasticsearch Indexing Speed with These Tips.
- For a guide on optimising slow or expensive search queries please see: 10 Important Tips to Improve Search in Elasticsearch.
