Frozen Index/Node questions

Elastic Stack Elasticsearch
1

Hi,
I have some questions regarding frozen indices.

  1. Is there a possibility to declare a node as a "frozen node"? I have a cluster with 3 nodes and I am wondering if I could ad a node which takes all the indices that are frozen by the ILM. Lets say a index is 30Days old and it gets frozen by the ILM is there a way that the index is automatically transfered to the frozen node and not replicated across other nodes?

  2. It is stated that a frozen index has less overhead. But my frozen indices take up the same disk space as the unfrozen version. Is this normal? My index is 73GB and has 114Mio documents.

  3. How do you use frozen indices in your work environment? What are the capabilities of a frozen index?

  4. Is a Hot/Frozen Cluster a good idea? I don't think I need a warm cluster because its neither a hot nor a frozen thing. I want either really fast results or less used disk space.

Thanks,
defalt.

2

Frozen indices reduce heap usage but does not affect disk usage. If you are on the latest version of Elasticsearch you may not need to freeze indices as heap usage has been reduced quite a lot.

3

So the freeze stuff is deprecated? Good to know. In your opinion whats the best idea to store data for a long time. We store data over the course of years and data which is older than 30Days is rarely searched. So we are looking for an option to store this data away and leave room for the "interesting" data. Our idea was a Hot/Frozen structure but maybe a Hot/Warm is better?

4

Frozen indices are not deprecated and may be very useful if you want very dense nodes. You will in recent version however get further without having to use frozen indices so it will depend on your use case. Having two zones make sense but whether this is warm or cold probably depends on hardware and your expectations.

5

Ok and for understanding. It is possible to have 3 Hot and 2 Cold nodes and the Hot ones only hold hot indices and the cold ones only hold cold indices. Or are they all split up across the cluster as they are normally?

6

Yes you can configure that using shard allocation filtering.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.