Compressing and forcemerging past time-based indices

Elastic Stack Elasticsearch
#1

I have a bunch of past monthly indices that are read-only since no data is being indexed to them. I was thinking of applying best_compression on them and then invoke the _forcemerge api to reduce the num_segments to 1.

I can close those monthly indices --> apply best_compression --> open them again --> forcemerge them.

Is this the correct approach? Or that best_compression cannot be applied to existing indices?

#2

Yep!

2 Likes
#3

Thank you very much :+1: Will it have any performance impact on queries?

#4

Better compression isn't free. It'll have some impact, but how much you will need to measure.

#5

Understood. Thanks. I was hoping that with forcemerging to 1 segment, hopefully it may not have that much impact.

#6

It shouldn't, but it's not something I think you will find anyone will guarantee.

#7

Thank you. Yes agree on that. Will measure it. One question here: In case I opt to best_compression and find that the query times have increased, what option do I have?

#8

You should be able to revert that with a settings change and another force merge.

#9

Awesome. Thank you very much.

#10

Using best_compression primarily adds overhead at indexing time so should not affect query latencies at all. I also do not think you need to close the index.

1 Like
#11

Wow. That's great to hear. So just set the compression and forcemerge to 1 segment?

#12

Yes.

#13

Excellent. Thanks. By the way, if we have forcemerged before to 5 segments, we can again forcemerge to 1 segment. Correct?

#14

No, as far as I know that will not change anything’s my. Be aware that forcemerging large shards can take a long time and result in a good amount of disk I/O.

1 Like
#15

Noted. Thanks for all your inputs. Much appreciated.

#16

@Christian_Dahlqvist and @warkolm - truly amazed at the support you guys are providing. Very much grateful.

1 Like
#17

Hi @Christian_Dahlqvist - would it be okay if I forcemerge multiple indices (say 3 to 5 indices) in parallel in a huge cluster of 50 TB (10 data nodes and 3 master nodes. Each data node is 8 TB with 16 cores and 56 GB RAM) or that the recommendation is to forcemerge only 1 index at a time?

#18

It typically depends more on how fast your storage is than the amount of RAM or CPU as it results in a lot of disk I/O and used up disk space while in progress. Try and see how if affects your cluster and what limit you can tolerate.

1 Like
#19

Note that there is only one force-merge thread. If a force merge is already running and you request another then the later requests are placed in a queue and processed in turn.

2 Likes
#20

Thanks Christian. The data nodes SSDs have max IOPS of 5000 with Max throughput being 200 MB/sec.