ES 7.5.0 gets OOM

I am new to ELK and would like to use ES in connection with Logstash.
Logstash is supposed to put around 15MB of data to ES.
However my ES (which is run in Docker) does not behave stable.
After about few minutes the container is down and the last logs indicate that there are memory problems:
{"type": "server", "timestamp": "2019-12-19T13:38:21,613Z", "level": "WARN", "component": "o.e.m.j.JvmGcMonitorService", "": "elasticsearch", "": "elasticsearch", "message": "[gc][young][286][71] duration [3s], collections [1]/[1.3s], total [3s]/[7.2s], memory [325.8mb]->[341mb]/[990.7mb], all_pools {[young] [251.8mb]->[4mb]/[266.2mb]}{[survivor] [4.5mb]->[5.5mb]/[33.2mb]}{[old] [71.6mb]->[71.6mb]/[691.2mb]}", "cluster.uuid": "gl37Eo6uROmeNink4VhWeg", "": "69Z2EvjeQiidUzkfFtUz4A" }
{"type": "server", "timestamp": "2019-12-19T13:38:22,113Z", "level": "WARN", "component": "o.e.m.j.JvmGcMonitorService", "": "elasticsearch", "": "elasticsearch", "message": "[gc][286] overhead, spent [3s] collecting in the last [1.3s]", "cluster.uuid": "gl37Eo6uROmeNink4VhWeg", "": "69Z2EvjeQiidUzkfFtUz4A" }
{"type": "server", "timestamp": "2019-12-19T13:39:50,226Z", "level": "INFO", "component": "o.e.x.m.p.NativeController", "": "elasticsearch", "": "elasticsearch", "message": "Native controller process has stopped - no new native processes can be started", "cluster.uuid": "gl37Eo6uROmeNink4VhWeg", "": "69Z2EvjeQiidUzkfFtUz4A" }

I am not quite sure what is going on because I run ES with custom jvm.options ie.
and this should be enough.
Could anyone help me out in determining what is going on, where to investigate? Thanks

It looks like Elasticsearch is running out of memory and that it only has 1 GB of Java Heap Size, so you need to increase it.

You need to set both -Xms and -Xmx to the same value, for instance


or perhaps even higher, if you keep getting OOM exceptions. I typically run with 8 GB Java Heap Size on my data nodes.

thanks. when both are the same, ES works fine :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.