I fear I don't understand what are you trying to achieve. free shows system-wide memory usage whereas the Kopf plugin only shows Java heap usage of the Elasticsearch process. First, Elasticsearch stores all kinds of things off-heap (in the OS filesystem cache) which you will simply not see in Kopf and second your operating system and other processes will also need memory. I hope this points you in the right direction.
The "Cached" output is the OS page cache, which indicates that just around 800MB are in use. You cannot really attribute that to a single process but I think it is still reasonable to say that most of that is used by ES. By the way, the page cache is entirely managed by the OS. It decides when entries need to be evicted, so there is no setting in Elasticsearch which you can tune. Also on OS level, it is not easily / directly changeable.
"Mlocked" indicates the amount of (Heap) memory that ES has locked (i.e. preventing the OS to swap it out). It's more than 4GB, maybe the JVM is allocating also some space in addition what is set by -Xmx. It's also possible that other processes mlock memory (as meminfo just provides a system-global view).
"Slab" is Kernel reserved memory and a little bit over 1GB.
Let us do a quick back of the envelope calculation: the three before-mentioned parts together account for roughly 800MB + 5GB + 1GB = 6.8GB. You have 350MB free, leaving around 800 - 900 MB for all the rest of the system, which is not too much. You can try to reduce the heap size or allocate more memory to the machine. Off-heap memory usage is definitely not your problem here.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
