# Help understanding hot threads (CPU 100% for several hours)

**URL:** <https://discuss.elastic.co/t/help-understanding-hot-threads-cpu-100-for-several-hours/152069>\
**Category:** Elasticsearch\
**Created:** [October 11, 2018, 2:15pm UTC](https://discuss.elastic.co/t/help-understanding-hot-threads-cpu-100-for-several-hours/152069 "2018-10-11T14:15:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![carasel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carasel/32/51435_2.png) [@carasel](https://discuss.elastic.co/u/carasel)\
**Post date:** [October 11, 2018, 2:15pm UTC](https://discuss.elastic.co/t/help-understanding-hot-threads-cpu-100-for-several-hours/152069/1 "2018-10-11T14:15:28Z")

</div>

I indexed a lot of data into my elasticsearch cluster several hours ago. The CPU utilization went to 100% while this was happening, but now that it has finished (about 3 hours ago) the CPU utilization is still 100%. I had the refresh interval est to "-1" during the indexing, but have since set it to "60s".

I have been looking at the output of hot threads, but can't work out what is happening with my cluster, as far as I know there are very few queries going to it now. It seems like a lot of the output is from log4j and netty.

My hot\_threads output: [https://gist.github.com/carasel/34467b214bd71e9680da3ffa4d8584b2](https://gist.github.com/carasel/34467b214bd71e9680da3ffa4d8584b2)

I have 300 shards (including replication of 1) across 30 indices, 3 master nodes, 4 data nodes.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 15, 2018, 11:20am UTC](https://discuss.elastic.co/t/help-understanding-hot-threads-cpu-100-for-several-hours/152069/2 "2018-10-15T11:20:49Z")

</div>

- node `mGhV-nU` is busy right now with compressing logs
- node `NeCaeFk` is also compressing logs, but also runs a regex query? Just guessing due to your redacted parts, you may want to show those as well.
- node `IjibcFs` runs a more like this query, scoring
- node `SSt5weZ` is doing some scoring + more like this as well

Are you logging a lot of things? Apart from that we have some normal searches going on, from this 2 minute check.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2018, 11:20am UTC](https://discuss.elastic.co/t/help-understanding-hot-threads-cpu-100-for-several-hours/152069/3 "2018-11-12T11:20:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.