Data/write/bulk tasks appearing on master nodes

Elastic Stack Elasticsearch
1

I'm seeing some strange usage patters on dedicated master nodes in a 5.6.16 Elasticsearch cluster.
Master nodes seem to be having excessive heap pressure during some workloads, causing them to crash with OOM errors. When fetching the tasks for the current master with

GET _tasks?nodes=LI7yjqmNRUiHfHzanCQmeQ&actions=*bulk&detailed

some bulk write tasks appear, but without any details about the index or the exact query.

{
  "nodes": {
    "LI7yjqmNRUiHfHzanCQmeQ": {
      "name": "xxx_master-1",
      "transport_address": "10.0.201.159:9300",
      "host": "10.0.201.159",
      "ip": "10.0.201.159:9300",
      "roles": [
        "master"
      ],
      "attributes": {
        "ml.max_open_jobs": "10",
        "ml.enabled": "true"
      },
      "tasks": {
        "LI7yjqmNRUiHfHzanCQmeQ:100703207": {
          "node": "LI7yjqmNRUiHfHzanCQmeQ",
          "id": 100703207,
          "type": "transport",
          "action": "indices:data/write/bulk",
          "description": "",
          "start_time_in_millis": 1632838233217,
          "running_time_in_nanos": 256009211,
          "cancellable": false
        }
      }
    }
  }
}

I have two concerns, why aren't there any details in the response, and why are there bulk write tasks running on a dedicated master? Any ideas?
Thanks,
Nikola

2

Welcome to our community! :smiley:

5.X is very well past EOL. You need to upgrade as a matter of serious urgency as you are unlikely to get any advice other than "upgrade" sorry to say.

We'd need to see the logs. And the output from the _cluster/stats?pretty&human API?

But your best bet is to upgrade.

3

Thanks for the welcome!
Yes, the migration to ES v7 is underway, but until that is finished, these v5 clusters still need some care.
This was more of a theoretical question, why would "action": "indices:data/write/bulk" appear on a dedicated master, and why doesn't it provide any details for the task (description is empty)?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.