Elasticsearch Threshold



Elasticsearch Threshold

Opster Team

July 2020, Version: 1.7-7.9


In addition to reading this guide, run the free Elasticsearch Health Check-Up. Get actionable recommendations that can improve performance and prevent incidents (does not require any installation). Among the dozens of checks included are: shards sizes, search errors, thread pools, management queue size, circuit breakers and many more. Join over 700 users who use this free tool.

Threshold in Elasticsearch

What it is:

Elasticsearch uses several parameters to enable it to manage hard disk storage across the cluster. 

What it’s used for:

  • Elasticsearch will actively try to relocate shards away from nodes which exceed the disk watermark high threshold.
  • Elasticsearch will NOT locate new shards or relocate shards on to nodes which exceed the disk watermark low threshold.
  • Elasticsearch will prevent all writes to an index which has any shard on a node that exceeds the disk.watermark.flood_stage threshold.
  • The info update interval is the time it will take Elasticsearch to re-check the disk usage

Examples:

PUT _cluster/settings
{
  "transient": {
   
    "cluster.routing.allocation.disk.watermark.low": "85%",
    "cluster.routing.allocation.disk.watermark.high": "90%",
    "cluster.routing.allocation.disk.watermark.flood_stage": "95%",
    "cluster.info.update.interval": "1m"
  }
}

Notes and Good Things to Know:

  • You can use absolute values (100gb) or percentages (90%), but you cannot mix the two on the same cluster. 
  • In general, it is recommended to use percentages, since this will work in case the disks are resized.
  • You can put the cluster settings on the elasticsearch.yml of each node,  but it is recommended to use the PUT _cluster/settings API because it is easier to manage, and ensures that the settings are coherent across the cluster.
  • Elasticsearch comes with sensible defaults for these settings, so think twice before modifying them.  If you find you are spending a lot of time fine-tuning these settings, then it is probably time to invest in new disk space.
  • In the event of the flood_stage threshold being exceeded, once you delete data, Elasticsearch should detect automatically that the block can be released (bearing in mind the update interval which could be, for instance, a minute).  However if you want to accelerate this process, you can unblock an index manually, with the following call:
PUT /my_index/_settings
{
  "index.blocks.read_only_allow_delete": null
}

Common Problems:

Inappropriate cluster settings (if the disk watermark.low is too low) can make it impossible for Elasticsearch to allocate shards on the cluster.  In particular, bear in mind that these parameters work in combination with other cluster settings (for example shard allocation awareness) which cause further restraints on how Elasticsearch can allocate shards.


Related log errors to this ES concept


Cluster state update task took above the warn threshold of
Cluster state applier task took above the warn threshold of
flood stage disk watermark [95%] exceeded on
After allocating; node would have more than the allowed
replicas will not be assigned to this node
After allocating; node would have less than the required threshold of
Rerouting shards:
After allocating; node would have less than the required free bytes threshold ( bytes free); preventing allocation
After allocating; node would have more than the allowed free disk threshold ( free); preventing allocation
Failed to flush shard on translog threshold
After allocating. node would have less than the required % free disk threshold (% free). preventing allocation
After allocating. node would have less than the required free disk threshold ( free). preventing allocation

< Page: 1 of 2 >




Improve Elasticsearch Performance

Run The Analysis