We are using AWS managed Elasticsearch of instance type r4.xlarge with 4 nodes available in 2 zones and EBS storage size per node is 1000GB.
Version of Elasticsearch is 6.2.
Data streaming into ES is done via logstash and it is realtime streaming data.
We are holding the logs on day based indices and only 30 days data will be available.Each day data holds a max of 45gb and we are using terms, date_histogram, cardinality aggregation queries(on 30 indices).For every second, we are making 400 requests, which has the combination of above mentioned aggregations on the 30 indices data.We are facing the high CPU utilisation often.
Please help us in reducing the cpu utilisation