# Best Way to Ensure Elasticsearch Optimal Performance

**URL:** <https://discuss.elastic.co/t/best-way-to-ensure-elasticsearch-optimal-performance/356290>\
**Category:** Elasticsearch\
**Created:** [March 27, 2024, 2:05pm UTC](https://discuss.elastic.co/t/best-way-to-ensure-elasticsearch-optimal-performance/356290 "2024-03-27T14:05:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mibeyki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mibeyki/32/106771_2.png) [@mibeyki](https://discuss.elastic.co/u/mibeyki)\
**Post date:** [March 27, 2024, 2:05pm UTC](https://discuss.elastic.co/t/best-way-to-ensure-elasticsearch-optimal-performance/356290/1 "2024-03-27T14:05:20Z")

</div>

Hello,

I am writing to seek guidance on how to ensure optimal performance of Elasticsearch cluster.

I am running a three node ES cluster with huge resources (16vCPUs, 128GB RAM, 10 TB Disk) on each node.  
However, i am collecting logs from 300+ servers and the index is created in the format, _(ilm is auto)_, is **index-name-{now/d}-000001**. This basically creates an index every day and rolls over index like every 30 days or when it gets to 50G.  
however, the indices are growing way too large (more than 3000 shards currently) and I feel like this is affecting the cluster as depicted by constant timeouts when executing some queries or even trying to save some settings like creating new ingest pipelines which always give 504 gateway timeout.  
Elasticsearch logs show timeout in connecting to other cluster nodes.  
Any idea to optimize my cluster?

I hope i communicated the issue well. Pardon me if I didn't.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 27, 2024, 2:11pm UTC](https://discuss.elastic.co/t/best-way-to-ensure-elasticsearch-optimal-performance/356290/2 "2024-03-27T14:11:44Z")

</div>

What is the full output of the [cluster stats API](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/cluster-stats.html)?

What is the retention period for your data?

What type of storage are you using? Local SSDs?

---

<div class="post-metadata">

**Author:** ![mibeyki](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mibeyki/32/106771_2.png) [@mibeyki](https://discuss.elastic.co/u/mibeyki)\
**Post date:** [March 27, 2024, 2:43pm UTC](https://discuss.elastic.co/t/best-way-to-ensure-elasticsearch-optimal-performance/356290/3 "2024-03-27T14:43:47Z")

</div>

Hi @Christian_Dahlqvist  
Please see the info below;  
What is the full output of the [cluster stats API](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/cluster-stats.html)?  
Sorry not able to get this output currently but here is the output from the command i executed some time today.

```auto
{
  "_nodes" : {
    "total" : 3,
    "successful" : 3,
    "failed" : 0
  },
  "cluster_name" : "elk",
  "cluster_uuid" : "vsdHTS8LQ2GRlsX7XQr_9Q",
  "timestamp" : 1711543091000,
  "status" : "yellow",
  "indices" : {
    "count" : 1604,
    "shards" : {
      "total" : 2603,
      "primaries" : 2543,
      "replication" : 0.023594180102241447,
      "index" : {
        "shards" : {
          "min" : 1,
          "max" : 6,
          "avg" : 1.6228179551122
        },
        "primaries" : {
          "min" : 1,
          "max" : 3,
          "avg" : 1.5854114713216958
        },
        "replication" : {
          "min" : 0.0,
          "max" : 1.0,
          "avg" : 0.03449709060681629
        }
      }
    },

```

What is the retention period for your data?  
1 yr  
What type of storage are you using? Local SSDs?  
datacentre HDD

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 27, 2024, 2:56pm UTC](https://discuss.elastic.co/t/best-way-to-ensure-elasticsearch-optimal-performance/356290/4 "2024-03-27T14:56:34Z")

</div>

The stats output is only partial, so not much to comment on there. Will need to see the rest to draw any conclusions.

> [@mibeyki](#):
>
> What type of storage are you using? Local SSDs?  
> datacentre HDD

Elasticsearch is often limited by disk I/O. I would recommend running `iostat -x` on the nodes and see what await looks like. I would not be surprised if this is your main issue. Note that the use of SSDs is recommended in [the search performance tuning guide](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/tune-for-search-speed.html#_use_faster_hardware_2) as well as [the guide for optimizing indexing throughput](https://www.elastic.co/guide/en/elasticsearch/reference/8.12/tune-for-indexing-speed.html#_use_faster_hardware).

It may also be worthwhile looking into how you handle sharding and index data. If you are actively writing to a significant number of indices and shards this may result in a lot of small writes and resulting IOPS, which may not be ideal for slower disks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2024, 2:57pm UTC](https://discuss.elastic.co/t/best-way-to-ensure-elasticsearch-optimal-performance/356290/5 "2024-04-24T14:57:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.