Elasticsearch Elasticsearch Memory: Reducing Memory Allocated to Hot Nodes

By Opster Team

Updated: Mar 10, 2024

| 2 min read

What does this mean?

The memory allocation for the hot nodes in your Elasticsearch cluster is higher than necessary. Hot nodes are the nodes that handle the indexing and searching of recent data. By reducing the memory allocated to these nodes, you can optimize the memory-to-disk ratio, leading to improved performance efficiency and cost savings.

Why does this occur?

This may have occurred due to one or more of the following reasons:

  1. Over-provisioning of memory resources for the hot nodes.
  2. Inefficient data distribution across the nodes.
  3. Inadequate monitoring and management of memory usage.

Possible impact and consequences of excessive memory on hot nodes

The potential impact of this issue includes:

  1. Increased costs due to over-provisioning of memory resources.
  2. Reduced performance efficiency, as excessive memory allocation can lead to inefficient resource utilization.
  3. Hindered scaling efficiency, as adding more nodes with high memory allocation may not necessarily improve performance.
  4. Increased I/O operations, as the system may struggle to manage the excessive memory allocation.
  5. Difficulty in resource consolidation, which can lead to further inefficiencies and increased costs.

How to resolve

To resolve the issue of excessive memory allocation to hot nodes, consider the following recommendations:

1. Improve your memory-to-disk ratio by moving to instances with a smaller amount of memory or reducing the memory allocated to the nodes.This can be done by creating a custom JVM options file (to be located in the config/jvm.options.d folder) and setting the appropriate heap size for your data nodes. For example:

# Set the heap size to 50% of available memory, up to a maximum of 32GB

2. Reduce the number of hot data nodes and increase disk allocated accordingly: By reducing the number of hot data nodes in your cluster, you can consolidate resources and allocate more disk space to the remaining hot nodes. This can be done by updating the cluster settings to drain data to other hot nodes so that the specified hot node can be deprovisioned:

PUT /_cluster/settings
  "transient": {
    "cluster.routing.allocation.exclude._ip": "IP_ADDRESS_OF_NODE_TO_REMOVE"

Replace “IP_ADDRESS_OF_NODE_TO_REMOVE” with the IP address of the hot data node you want to remove from the cluster.

3. Optimize data storage and indexing strategies: Review your data storage and indexing strategies to ensure that they are efficient and make the best use of available resources. This may involve reindexing your data, adjusting mappings, or implementing custom analyzers.

4. Monitor and adjust resource allocation: Regularly monitor your Elasticsearch cluster’s performance and resource utilization to ensure that the memory-to-disk ratio remains optimal. Adjust the memory allocation and other settings as needed to maintain optimal performance and cost efficiency.


By following this guide and implementing the recommendations provided, you can reduce the memory allocated to hot nodes in your Elasticsearch cluster, leading to improved performance efficiency and cost savings. Regular monitoring and management of memory usage will ensure that your search deployment remains optimized and cost-effective.

How helpful was this guide?

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?