From the slow indexing log on the machine.
I guess you sort of answered the question. If increasing refresh rate is simply delaying search ability, then the log suggests I am experiencing occasional long indexing episodes, which is not good when it gets to tens of seconds.
Is my assumption correct to worry about multi-second indexing time?
I know the recommendation is to have no more than 64GB of RAM (assign < 32GB to ES), but when it comes to bumping instance, will more RAM (beyond 64GB) or CPU be better overall?
I have asked this question before but nobody seems to be able to answer it. So I vote for the route of more CPU, which doesn't seem to help in indexing time. We are using ES in write heavy application (about 90% write).
If I give more RAM to OS (98GB) and keep ES at say 30GB, shouldn't the OS be able to utilize the extra RAM for file caching? Which in term should improve overall performance?
Any insight would be appreciated.