# Cluster Optiomization

**URL:** https://discuss.elastic.co/t/cluster-optiomization/215610
**Category:** Elasticsearch
**Created:** [January 19, 2020, 9:38am UTC](https://discuss.elastic.co/t/cluster-optiomization/215610 "2020-01-19T09:38:31Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ragian](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@ragian](https://discuss.elastic.co/u/ragian)
#### Post date: [January 19, 2020, 9:38am UTC](https://discuss.elastic.co/t/cluster-optiomization/215610/1 "2020-01-19T09:38:31Z")

</div>

I need to optimize my elasticsearch cluster to have better performance on all kind of queries.

The current configuration of the cluster is:

Elastic 6.4.0

3 nodes (master, data, ingest)

- 4 core
- 16 GB ram (heap 8GB)
- 1 EBS disk of 1TB

~ 200 indexes  
~ 4200 shard (12 shard per index, replica 1 (primary + its copy))  
~ 1.5 billion of documents  
~ 1.5 TB of data stored

more details about the indexes:

- 1 index of 100GB
- 80 indexes of 2GB each-one
- 80 indexes of 7GB each-one

Continues bulk update queries on the index of 100GB (refresh interval 2s).

Insert on the other indexes (about 10 inserts/second with refresh interval 60s)

Search query on all the indexes with a lot of queries using the index\_date\_\* pattern and that has to scan a lot of indexes (80).

The biggest problem that I have with this configuration is an high load of master server when a query that has to scan 80 indexes is launched. The singular query takes about 2 seconds but a lots of this query are launched in parallel and the execution time increase (until 20 seconds and more) with the master server with a very high load.

I was thinking to a new clustes configuration like this:

3 nodes (data, ingest) (AWS EC2 i3.xlarge instances)

- 4 cores
- 30 GB ram (heap 24GB)
- Local storage NVMe

3 nodes (master) (AWS EC2 i3.large instances)

- 2 core
- 15GB ram (heap 9GB)
- Local storage NVMe

I know that the only way to validate the configuration is a test the configuration on the field but according to your experiance, it could be a good starting point to manage my data?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 19, 2020, 9:47am UTC](https://discuss.elastic.co/t/cluster-optiomization/215610/2 "2020-01-19T09:47:59Z")

</div>

As far as I can tell you have far too many shards, which often have a negative impact on performance. Please read [this blog post](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster) for practical guidance. I would also recommend investigating what is limiting performance, e.g. checking disk I/O using `iostat` and monitoring CPU usage and GC.

I do think switching to i3 instances will help with disk I/O, which is often the bottleneck. As dedicated master nodes should not serve traffic (indexing or querying) they do not need to be large or have good storage. I would recommend using `m5.large` instances rather than `i3.large`.

---

<div class="post-metadata">

### Author: ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [January 19, 2020, 10:21am UTC](https://discuss.elastic.co/t/cluster-optiomization/215610/3 "2020-01-19T10:21:26Z")

</div>

> [@ragian](#):
>
> ~ 4200 shard (12 shard per index, replica 1 (primary + its copy))

This is far too many shards, which is a common source of performance issues.

> [@ragian](#):
>
> - 80 indexes of 2GB each-one
> - 80 indexes of 7GB each-one

These small indices would be better off having just a single primary, and it would be even better to combine them further into larger indices. If they are time-based indices then consider using [rollover](https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-rollover-index.html), maybe via [ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html), to roll over less frequently so you can target a larger shard size.

Here is an article that gives more details on shard count:

> **[How many shards should I have in my Elasticsearch cluster?](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2020, 10:21am UTC](https://discuss.elastic.co/t/cluster-optiomization/215610/4 "2020-02-16T10:21:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
