Elasticsearch is crashing my system

Elastic Stack Elasticsearch
1

PLEASE HELP : URGENT REQUEST! I NEED HELP WITH EL

I have just started using elasticsearch to sort the data that comes to my DB (I used to use MySQL earlier)
I get about 30 Million records per-day, and when I try searching for data, the system hangs or crashes even. EL uses up all my memory.

Data scales vertically as if now. And I recently read somewhere that horizontal scaling of data is much better than the vertical approach.

I am lost on how to achieve this using elasticserach.

PLEASE HELP !

Here is the Schema design i used. I am not sure if this is how this needs to be done so that I can scale it to the data needs that I have. What should I change so that my system does not Hang / Crash ? ( I have a 75 gig HD and 16 GB RAM and 8 CPU server )

PUT event
{
                    "settings": {
                        "analysis": {
                            "normalizer": {
                                "lc_normalizer": {
                                "type": "custom",
                                "char_filter": [],
                                "filter": ["lowercase", "asciifolding"]
                                }
                            }
                        }
                    },
                    "mappings": {
                            "events": {
                            "properties": {
                                "idx":              { "type": "keyword","index" : "true" },
                                "scrip":            { "type": "integer", "index" : "true" },
                                "entered":          { "type": "date"   , "index" : "true"  , "format": "strict_date_optional_time||epoch_millis" },
                                "enteredDate":      { "type": "keyword"   , "index" : "true"},
                                "serverDate":       { "type": "keyword"   , "index" : "true"},
                                "customer":         { "type": "keyword", "index" : "true" },
                                "machine":          { "type": "keyword", "index" : "true" },
                                "username":         { "type": "text", "index" : "false" },
                                "clientversion":    { "type": "text", "index" : "false" },
                                "clientsize":       { "type": "integer", "index" : "false" },
                                "priority":         { "type": "keyword", "index" : "true" },
                                "description":      { "type": "keyword", "index" : "true" },                        
                                "type":             { "type": "text", "index" : "false" },
                                "path":             { "type": "text", "index" : "false" },
                                "executable":       { "type": "keyword", "index" : "true" },
                                "version":          { "type": "text", "index" : "false" },
                                "size":             { "type": "integer", "index" : "false" },
                                "id":               { "type": "integer", "index" : "true" },
                                "windowtitle":      { "type": "keyword", "index" : "false" },
                                "string1":          { "type": "keyword", "index" : "true", "normalizer": "lc_normalizer" },
                                "string2":          { "type": "keyword", "index" : "true" },
                                "text1":            { "type": "text", "index" : "true" },
                                "text2":            { "type": "text", "index" : "true" },
                                "text3":            { "type": "text", "index" : "true" },
                                "text4":            { "type": "text", "index" : "true" },
                                "servertime":       { "type": "date"   , "index" : "true"  , "format": "strict_date_optional_time||epoch_millis" },
                                "uuid":             { "type": "keyword", "index" : "false" },
                                "Tags":             { "type": "keyword", "index" : "true" }
                            }
                        }
                    }
                }
2

Unfortunately there isn't much here to help us diagnose this.

What version are you on?
What OS, what JVM, how did you install things?
What does "crash" mean? What do the logs show?

3

@warkolm : Thank you so much for your reply. Please find my answers inline:

What version are you on?
Elasticsearch 6.2

What OS, what JVM, how did you install things?
OS: CentOS 7
JVM : 8
Installed using command "yum install elasticsearch"

What does "crash" mean? What do the logs show?
As we insert data, the RAM usage increases exponentially, and the system becomes unresponsive/hangs. It goes to 100% memory usage and the only way I could regain control was by closing the program and restarting it.

Log file says

[2018-06-20T14:38:29,926][INFO ][o.e.n.Node ] [] initializing ...
[2018-06-20T14:38:30,053][INFO ][o.e.e.NodeEnvironment ] [uUmorQj] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [11.4gb], net total_space [29.9gb], spins? [unknown], types [rootfs]
[2018-06-20T14:38:30,053][INFO ][o.e.e.NodeEnvironment ] [uUmorQj] heap size [1.9gb], compressed ordinary object pointers [true]
[2018-06-20T14:38:30,202][INFO ][o.e.n.Node ] node name [uUmorQj] derived from node ID [uUmorQjbSR2X8r7d954UiQ]; set [node.name] to override
[2018-06-20T14:38:30,203][INFO ][o.e.n.Node ] version[5.6.10], pid[8554], build[b727a60/2018-06-06T15:48:34.860Z], OS[Linux/3.10.0-693.11.6.el7.x86_64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/1.8.0_171/25.171-b10]
[2018-06-20T14:38:30,203][INFO ][o.e.n.Node ] JVM arguments [-Xms2g, -Xmx2g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -Djdk.io.permissionsUseCanonicalPath=true, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j.skipJansi=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/share/elasticsearch]

I am also attaching the yml file for your reference.

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /path/to/data
#
# Path to log files:
#
#path.logs: /path/to/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
#network.host: 192.168.0.1
network.host: 0.0.0.0

# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.zen.ping.unicast.hosts: ["host1", "host2"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
#
#discovery.zen.minimum_master_nodes: 3
#
# For more information, consult the zen discovery module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
4

How much memory on the host?
There should be more logs as well.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.