Opster Team

March 2021

In addition to reading this guide about Elasticsearch high CPU and learning how to resolve it, we recommend you run the Elasticsearch Health Check-Up. It will detect issues and improve your Elasticsearch performance by analyzing your shard sizes, threadpools, memory, snapshots, disk watermarks and more.

The Elasticsearch Check-Up is free and requires no installation.

Run the Elasticsearch check-up to receive recommendations like this:

Run Check-Up

The following configuration error was detected on node 123...

Description

This error can have a severe impact on your system. It's important to understand that it was caused by...

Recommendation

In order to resolve this issue and prevent it from occurring again, we recommend that you begin by changing the configuration to...

1

X-PUT curl -H "Content-Type: application/json" [customized recommendation]

Overview

High CPU is often a symptom of other underlying issues, and as such there are a number of possible causes for it.

Causes of high CPU should be investigated and fixed, because a distressed node will at best slow down query response times resulting in time outs for clients, and at worst cause the node to disconnect and be lost from the cluster altogether.

How to resolve it

To minimize the impact of distressed nodes on your search queries, make sure you have the following setting on your cluster (version 6.1 and above):

PUT /_cluster/settings
{
  "transient": {
    "cluster.routing.use_adaptive_replica_selection": true
  }
}

Below are some guides that can assist you in resolving this issue:

• High CPU is generally the consequence of JVM garbage collection which in turn is caused by configuration or query related issues. For a detailed guide  of JVM garbage collection, see: Heap Size Usage and JVM Garbage Collection in ES – A Detailed Guide.
• If the CPU is high only on specific data nodes, then you may have a load balancing or sharding issue. See Loaded Data Nodes – Important Elasticsearch Guide.
• CPU may also be a symptom of memory swapping to disk, if that has not been deactivated properly on the node. See: The Bootstrap Memory Lock Setting is Set to False – An Elasticsearch Guide. 
• If you have a large number of shards on your cluster, then you may have an issue with oversharding. Please see the document on Shards Too Small (Oversharding) – A Detailed Guide.
• In the case of inefficient indexing (ingestion), please see the tips on indexing optimisation here: Improve Elasticsearch Indexing Speed with These Tips.
• For a guide on optimising slow or expensive search queries please see: 10 Important Tips to Improve Search in Elasticsearch.

Run the Check-Up to get a customized report like this: