Elasticsearch indexing slow

[Kicker83 (Santiago Martinez)]

Hi everyone!

I have a server with logstash, elasticsearch and kibana, and my index rating is about 4,500/s (107.4m documents in about 14 hours)

The problem is I'm having a lot of delay between the syslogs events and the elasticsearch indexed event. The delay is about two hours.

I'm indexing bluecoat logs, and I'm parsing the logs in logstash with grok and csv.

The server has 12 CPU with 32 GB of RAM. The storage is NFS, and I think that could be the problem, but I don't know how to see, if thats the problem certainly.

Another important detail, is in XPack monitoring I can see the traffic graphs with blank spaces, I mean, it seems elasticsearch stops indexing for one second.

How could I troubleshoot this problem? Is there any tunning option to configure in elasticsearch? (I disabled replicas and I change the refresh_interval to 10s)

Thanks in advance!
Regards

[theuntergeek (Aaron Mildenstein)]

This is a single server? Not a clustered Elasticsearch? A single node can do a lot, but that might be part of the slowdown.

@Kicker83

The storage is NFS, and I think that could be the problem,

This is not recommended. In fact, do not ever do this. See our storage recommendations here.

@Kicker83

I can see the traffic graphs with blank spaces, I mean, it seems elasticsearch stops indexing for one second.

This could be any of a few things.

• Garbage collection in the JVM causes a pause in indexing
• Segment merges cause a pause in indexing (because you only have one node)
• Storage delays due to NFS (lock files and the like)
• Yet other possibilities.

These are most likely, though. Your best bet to get to real-time indexing is to have more nodes in your Elasticsearch cluster with local SSD storage.

[Kicker83 (Santiago Martinez)]

@theuntergeek Thanks so much for the info! I'll try to install another elasticsearch node (If someone gives me one server ). I'm afraid NFS is the only way I have to storage all data.