# Elasticsearch Cluster turns Red - Is JVM Heap main culprit?

**URL:** https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865
**Category:** Elasticsearch
**Created:** [February 18, 2019, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865 "2019-02-18T15:52:51Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Nikesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikesh/32/86579_2.png) [@Nikesh](https://discuss.elastic.co/u/Nikesh)
#### Post date: [February 18, 2019, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/1 "2019-02-18T15:52:51Z")

</div>

Hi,

I am indexing at a decent rate.  
20 indices each with 10000 fields and 50000 documents continuously indexing through 9 threads.  
I have a cluster with a dedicated master node and two data nodes. Each node has 16GB RAM and 8GB Heap size.  
No issues were found when only indexing the above mentioned scenario although it was at peak(let's say 6.5 to 7.5 GB). JVM Heap crossed the upper limit when more indexing and search requests were performed. Cluster went to Red Status and OOM error was thrown in logs.  
My doubts are :

1. What contributes to JVM Heap? As I have both text and keyword for a single field.  
**fielddata** stays in in-memory but is not enabled by default and I have not changed this behaviour.  
**Stored\_fields** also contributes to JVM Heap.  
I have attached Kibana Screenshot at the time of indexing (partly).

2. What measures can be taken to bring down Heap-Size or rather prevent Heap-Size to reach its maximum?

3.Even though I restarted my cluster, JVM Heap didn't drop down after giving it some time. What can be the causes of this?

 ![Screenshot%20(50)](https://us1.discourse-cdn.com/elastic/original/3X/0/2/0230b90342eac588ac20bedcc815ef454f219150.png)

---

<div class="post-metadata">

### Author: ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [February 18, 2019, 6:58pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/2 "2019-02-18T18:58:50Z")

</div>

> [@Nikesh](#):
>
> 10000 fields

Is that a typo? If not, that seems excessive and is likely to cause issues.

How many shards do you have?

---

<div class="post-metadata">

### Author: ![Nikesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikesh/32/86579_2.png) [@Nikesh](https://discuss.elastic.co/u/Nikesh)
#### Post date: [February 19, 2019, 4:53am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/3 "2019-02-19T04:53:20Z")

</div>

Thanks David for the response.  
Unfortunately, it's not an typo. It is common case for my users to have 5000-7000 fields per index.  
I have configured 2 primary shards and 1 replica per index.

---

<div class="post-metadata">

### Author: ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [February 19, 2019, 9:06am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/4 "2019-02-19T09:06:06Z")

</div>

> [@Nikesh](#):
>
> Unfortunately, it's not an typo. It is common case for my users to have 5000-7000 fields per index.

There's a good reason that the default limit in Elasticsearch is 1000 fields per index. I recommend working towards respecting that limit.

> [@Nikesh](#):
>
> I have configured 2 primary shards and 1 replica per index.

I meant in total. How many shards do you have in total? As in, what does `GET _cluster/health` report?

---

<div class="post-metadata">

### Author: ![Nikesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikesh/32/86579_2.png) [@Nikesh](https://discuss.elastic.co/u/Nikesh)
#### Post date: [February 19, 2019, 10:05am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/5 "2019-02-19T10:05:23Z")

</div>

My Cluster consists of 1300 shards!

---

<div class="post-metadata">

### Author: ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [February 19, 2019, 12:17pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/6 "2019-02-19T12:17:18Z")

</div>

This also sounds like too many for your cluster size. See this article for more detail:

> **[How many shards should I have in my Elasticsearch cluster?](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**

In particular:

> _A good rule-of-thumb is to ensure you keep the number of shards per node below 20 per GB heap it has configured._

Thus with 8GB of heap you should aim to limit yourself to 160 shards per node.

---

<div class="post-metadata">

### Author: ![Nikesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikesh/32/86579_2.png) [@Nikesh](https://discuss.elastic.co/u/Nikesh)
#### Post date: [February 28, 2019, 12:09pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/7 "2019-02-28T12:09:16Z")

</div>

Thanks David for your continuous help!

Is there a similar thumb rule as to how much GB of data a particular shard can hold?

---

<div class="post-metadata">

### Author: ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [February 28, 2019, 12:23pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/8 "2019-02-28T12:23:35Z")

</div>

From the very same article:

> _Aim to keep the average shard size between at least a few GB and a few tens of GB. For use-cases with time-based data, it is common to see shards between 20GB and 40GB in size._

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 28, 2019, 12:23pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-turns-red-is-jvm-heap-main-culprit/168865/9 "2019-03-28T12:23:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
